CVE Vulnerability Catalog

Nieprawidłowa walidacja danych wejściowych w ARM® Trusted Firmware używanym w AMD Zynq™ UltraScale+™ MPSoC/RFSoC może umożliwić uprzywilejowanemu atakującemu wykonanie odczytów poza dozwolonym zakresem, co może prowadzić do wycieku danych oraz odmowy usługi.

Spoofing vulnerability in Microsoft Office. The NVD description does not provide technical details of the exploitation mechanism.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. It is due to insufficient validation of user-supplied input, and an attacker could inject malicious code into specific pages of the interface.

The web-based management interface of Cisco ISE insufficiently validates user-supplied input, allowing an authenticated remote attacker to conduct an XSS attack. The attacker can inject malicious code into specific interface pages and execute arbitrary script in the victim's context.

In the Linux kernel, there is an issue with large page cache sizes when the base page size is 64 KB and the huge page size is 512 MB. The xarray structure cannot support arbitrary page cache sizes, leading to a WARN_ON() in xas_split_alloc(). The fix adjusts MAX_PAGECACHE_ORDER to a value supported by xarray and avoids PMD-sized page cache in the synchronous readahead path and for shmem files.

A flaw in the Linux kernel's shmem page cache handling occurs when PMD-sized page cache exceeds the maximum size supported by xarray. This leads to warnings and errors during xarray entry splitting, potentially causing system instability. The fix disables PMD-sized page cache when HPAGE_PMD_ORDER is larger than MAX_PAGECACHE_ORDER.

In the Linux kernel BPF timers, a deadlock can occur when two timer callbacks attempt to cancel each other's timers via bpf_timer_cancel. Both calls wait for the other callback to finish, causing a lockup. The fix introduces an atomic 'cancelling' counter in bpf_hrtimer to detect concurrent cancellation requests and return -EDEADLK instead of blocking.

The contextual menu for links could provide an opportunity for cross-site scripting attacks. This vulnerability affects Firefox for iOS < 129.

Long pressing on a download link could potentially provide a means for cross-site scripting. This vulnerability affects Firefox for iOS < 129.

Long pressing on a download link could potentially allow Javascript commands to be executed within the browser. This vulnerability affects Firefox for iOS < 129.

A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.

A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a local attacker to perform a password brute force attack due to improper restriction of excessive authentication attempts.

Vim before v9.1.0648 has a double-free vulnerability in dialog_changed(). When abandoning a buffer, Vim may ask the user what to do. If the buffer had no name and the user chooses to save, Vim creates a new Untitled file, but setting the buffer name leads to a double-free, possibly causing heap-use-after-free and crash.

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote when shared channels are enabled. A malicious remote can make an arbitrary local channel read-only.

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, and 9.8.x <= 9.8.1 fail to properly validate synced posts when shared channels are enabled. A malicious remote can create, update, or delete arbitrary posts in arbitrary channels.

Dell Inventory Collector versions prior to 12.3.0.6 contain a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to achieve arbitrary code execution on the system.

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

In the Linux kernel s390/pkey subsystem, memzero_explicit() and kfree() were replaced with kfree_sensitive() to fix Coccinelle warnings. The warnings indicated opportunities for kfree_sensitive/kvfree_sensitive at lines 1506, 1643, and 1770.

In the Linux kernel, the s390/pkey subsystem fails to wipe sensitive data from the stack for all IOCTLs that convert a clear-key into a protected- or secure-key on failure.