CVE Vulnerability Catalog

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 do not restrict domains in CORS, potentially allowing an attacker to perform privileged actions and retrieve sensitive information.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 use weaker than expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information.

In the Linux kernel, a vulnerability was found due to overly strict assertions (WARN_ON) when file handle encoding fails. These assertions are incorrect because encoding can fail for various reasons, and main users (nfsd, name_to_handle_at) are already prepared to handle errors.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions. A check for granularity 0 was added.

In the Linux kernel, the functionfs_bind function in the usb: gadget: f_fs module contains an unnecessary WARN_ON that can cause a kernel panic when panic_on_warn is enabled. This occurs due to a race condition between adb operations (open/read/write) and the function binding process triggered by a UDC write via configfs. The vulnerability is fixed by removing the unnecessary WARN_ON.

In the Linux kernel, in the HNS3 network driver, there is an issue with auto-enabling the misc interrupt vector. There is a time window between enabling interrupts and initializing the service task, during which an interrupt can trigger a warning and potentially incorrect behavior.

A vulnerability in the hns3 network driver for HIP08 devices causes a kernel crash. HIP08 devices do not register PTP devices, so the hdev->ptp pointer is NULL, but the transmit path still attempts to set hardware timestamp info with the SKBTX_HW_TSTAMP flag, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.

A vulnerability in the Linux kernel's AMD PMC driver (platform/x86/amd/pmc) causes an unbalanced IRQ1 wake disable when i8042 did not enable the wakeup, leading to a WARN() warning and potential wake_depth underflow.

In the Linux kernel, a bug was fixed in the rds_tcp_rcvbuf and rds_tcp_sndbuf sysctl handling where current->nsproxy was used, which could be NULL and cause a null-ptr-deref (Oops). The issue was spotted by syzbot using acct(2).

A Cross-Site Scripting (XSS) vulnerability was found in sunnygkp10 Online Exam System master version. It allows a remote attacker to steal sensitive information via the 'w' parameter.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String. An attacker can cause the webapp to crash by creating and sending such a post to a channel.

A path traversal vulnerability in Fortinet FortiRecorder, FortiVoice, and FortiWeb allows an attacker to escalate privileges via specially crafted packets.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post props, allowing a malicious authenticated user to cause a crash via a crafted post.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post props, allowing a malicious authenticated user to cause a crash via a malicious post.

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.

A false-positive warning in the Linux kernel workqueue subsystem has been fixed. The warning occurred when cancelling WQ_MEM_RECLAIM work from a context not marked as such, e.g. in the amdgpu driver. Cancelling such work is safe, so the warning criteria were relaxed.

A bug in the Linux kernel's memory reclaim mechanism (vmscan) can cause system hangs. The throttle_direct_reclaim() function may loop indefinitely because allow_direct_reclaim() incorrectly deems a memory zone unreclaimable despite having sufficient free pages. This occurs when a zone lacks reclaimable pages (e.g., file-backed or anonymous) and the system has no swap.

A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, causing a Denial of Service (DoS). To recover from this DoS, the network must be re-established.

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups "SuperUser", "Admin", or "Maintainer".