CVE Vulnerability Catalog

The Paragraphs table module for Drupal has an insufficient granularity of access control vulnerability that allows content spoofing. This affects versions before 1.23.0 and 2.0.0 before 2.0.2.

Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, and 10.1.x <= 10.1.3 fail to properly validate post types, allowing attackers to deny service to users with the sysconsole_read_plugins permission by creating a post with the custom_pl_notification type and specific props.

In the Linux kernel, the quota subsystem has a race during filesystem freeze because the quota_release_work queue is not always flushed in the quota writeback path. This can lead to a WARN_ON when a transaction starts while the filesystem is frozen.

In the Linux kernel's net/sched subsystem, the netem qdisc incorrectly tracks packet counts when it has a child qdisc. Backlog updates from the child (e.g., tbf) are not properly reflected in netem's 'qlen', causing it to reach the configured limit even when the internal tfifo is not full. This results in the enqueue function stopping and the interface locking up.

A Cross Site Scripting (XSS) vulnerability in iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.

When using an invalid protocol scheme, an attacker could spoof the address bar. This issue only affected Android operating systems. Fixed in Firefox 134.

When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, potentially leading to use-after-free. Fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

The WebChannel API did not check the sending principal but accepted the principal being sent, which could lead to privilege escalation attacks. Fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

An Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script.

Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser.

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.

A Cross Site Scripting (XSS) vulnerability in Audiocodes MP-202b version 4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.

In the Linux kernel, a bug was fixed in mlx5vf_add_migration_pages() in vfio/mlx5 where, if pages failed to be added to the SG table, they were not freed, leading to a memory leak.

In the Linux kernel SMB subsystem, a tcon reference leak occurs when a lease break races with opening the cached directory. Processing the lease break may take a reference to the tcon in cached_dir_lease_break() and then fail to release it in cached_dir_offload_close because cfid->tcon is still NULL. The fix initializes cfid->tcon before network operations.

W jądrze Linuxa rozwiązano podatność związaną z obsługą błędów w funkcji otx2_flows.c. Dodano sprawdzenie wskaźnika błędu po wywołaniu otx2_mbox_get_rsp().