CVE Vulnerability Catalog

In the Linux kernel USB gadget core, there was no check that the descriptor was set before reading maxpacket. This can cause a null pointer dereference and kernel panic.

In the Linux kernel x86/mtrr module, mtrr_save_state() did not check the fixed MTRR capability bit before accessing the MSRs. On CPUs without this capability, this causes a #GP exception and a WARN_ON().

Podatność CVE-2024-7077 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Semtek Sempos, co prowadzi do możliwości ataku typu Cross-site Scripting (XSS) odzwierciedlonego. Problem ten dotyczy wersji oprogramowania do 31 lipca 2024 roku.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.

Podatność CVE-2024-6920 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie NACPremium firmy NAC Telecommunication Systems Inc., co pozwala na ataki typu Stored XSS. Problem ten dotyczy wersji NACPremium do 8 stycznia 2024 roku.

In MISP versions up to 2.4.196, the app/Controller/BookmarksController.php file does not properly restrict access to bookmarks data when the user is not an org admin.

In the Linux kernel netfilter ctnetlink, the expectation deletion path did not call nf_expect_get_id() to calculate the ID. This leaks the least significant bit of the expectation object address to userspace.

An Open Redirect vulnerability was found in vTiger CRM v7.4.0 in the 'page' parameter. An attacker can craft a URL to redirect users to a malicious site.

A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.

A cross-site scripting (XSS) vulnerability in the /managers/enable_requests.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary scripts or HTML via the view parameter. This can lead to arbitrary JavaScript execution in the victim's browser.

A cross-site scripting (XSS) vulnerability in the /auth/AzureRedirect.php component of PicUploader (commit fcf82ea) allows attackers to inject arbitrary web scripts or HTML via the error_description parameter.

A cross-site scripting (XSS) vulnerability in the /login/disabled.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary web scripts or HTML via the username parameter.

An XSS vulnerability in the /master/auth/OnedriveRedirect.php component of PicUploader (commit fcf82ea) allows attackers to inject malicious scripts or HTML via the error_description parameter.

An XSS vulnerability in the /managers/multiple_freeleech.php component of Gazelle (commit 63b3370) allows attackers to inject malicious scripts or HTML via the torrents parameter.

A vulnerability in the Linux kernel exists due to improper synchronization in SCTP for reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(). Concurrent listen() calls on the same port and closing one socket can lead to a null-ptr-deref in reuseport_add_sock(). The issue is fixed by applying hash bucket locking in __sctp_hash_endpoint() and __sctp_unhash_endpoint().

W jądrze Linuxa naprawiono podatność polegającą na braku sprawdzania wskaźników null przed przekazywaniem zmiennych do funkcji. Wprowadzenie tego sprawdzenia eliminuje trzy problemy związane z NULL_RETURNS zgłoszone przez Coverity.

A null pointer dereference vulnerability exists in the Linux kernel's AMD display driver (drm/amd/display) within the dcn20_get_dcc_compression_cap function, triggered during hardware-accelerated video playback on DCN401 GPUs. This leads to a kernel oops and system hang.

In the Linux kernel, a vulnerability exists in the serial core layer where calling ioctl TIOCSSERIAL with an invalid baud_base can set uartclk to zero. This leads to a divide-by-zero error in uart_get_divisor(), causing a kernel oops.

In the Linux kernel, get_free_elt() can overflow tracing_map->next_elt. After overflow, elements can still be inserted into a full tracing_map, causing an infinite loop with preemption disabled and a CPU hang.

In the Linux kernel padata module, padata_mt_helper() could cause a divide-by-zero panic when ps->chunk_size was 0. This occurs when min_chunk in the padata_mt_job structure is 0.