CVE Vulnerability Catalog

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

Checking excessively long invalid RSA public keys may take a long time. Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service.

A vulnerability in the restore functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required. The issue is due to improper sanitization of backup file contents during restore. An attacker could exploit this by restoring a crafted backup file.

A Cross Site Scripting (XSS) vulnerability in Innovaphone myPBX versions v.14r1, v.13r3, and v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to the /CMD0/xml_modes.xml endpoint.

In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.

CMSeasy version 7.7.7.9 is vulnerable to arbitrary file deletion. An attacker can exploit this vulnerability to delete critical system files.

In the Linux kernel, the register_snapshot_trigger() function in the tracing/trigger subsystem returns success (0) even when snapshot allocation fails. This causes the snapshot trigger to be registered without reporting an error.

A flaw in the Linux kernel's copy_from_kernel_nofault() function allowed reading the vsyscall page from kernel space. This triggered a page fault and kernel oops because the vsyscall address was incorrectly treated as a userspace address, preventing the BPF fix-up from being applied. The issue was resolved by disallowing vsyscall page reads in copy_from_kernel_nofault().

In the Linux kernel, a null-ptr-deref vulnerability exists in the Bluetooth RFCOMM layer's rfcomm_check_security function. If the Bluetooth controller delays its response to a Read Encryption Key Size command until after the RFCOMM and L2CAP layers have disconnected but before the HCI layer disconnects, the function accesses an already freed l2cap_conn structure, causing a kernel crash. The fix checks if sk->sk_state is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx.

In the Linux kernel, the RISC-V PMU overflow handler incorrectly uses (1 << idx) on an int instead of BIT() when setting bits in the unsigned long overflowed_ctrs variable. This causes incorrect bit setting and a kernel panic (NULL pointer dereference) when running 'perf record -e branches' on Sophgo SG2042.

A kernel information leak vulnerability exists in the Linux kernel's do_sys_name_to_handle() function. Uninitialized bytes from a buffer allocated with kmalloc() are copied to user space. The issue is fixed by replacing kmalloc() with kzalloc(), which zeroes the allocated memory.

In the Linux kernel, the ath9k wifi driver's ath9k_wmi_event_tasklet() may run before all data structures are fully initialized. This is because the USB device is exposed to the USB subsystem before ath9k driver initialization completes.

In the Linux kernel, a memory leak exists in acpi_processor_power_exit(): after unregistering the CPU idle device, its associated memory is not freed, leading to a leak.

A flaw in the Linux kernel's IOMMU VT-d handling causes an ATS (Address Translation Services) invalidation request to be sent to a device that has already been disconnected (e.g., via hotplug). This triggers an infinite retry loop in interrupt context, leading to a hard lockup and kernel panic.

In the Linux kernel, the Bluetooth hci_core module has a possible buffer overflow. The name[8] field in struct hci_dev_info has a fixed size, so if hdev->name is larger, strcpy would write past its size.

W jądrze systemu Linux zidentyfikowano i naprawiono podatność, która mogła prowadzić do zakleszczenia (deadlock) podczas próby użycia sock_lock w funkcji .recvmsg. Zamiast tego zastosowano sk_receive_queue.lock w bt_sock_ioctl, aby uniknąć problemu z użyciem po zwolnieniu (UAF).

In the Linux kernel quota subsystem, a potential race leads to a NULL pointer dereference. The dquot_free_inode function may read the inode's quota pointer before quota_off sets it to NULL, and then use it after that change.

In the Linux kernel, the drm/bridge adv7511 driver has a bug during probe when an IRQ is pending before CEC initialization. This can cause a crash due to use of uninitialized data.

In the Linux kernel, the pvrusb2 driver (USB device driver for Hauppauge WinTV PVR USB2) contains a use-after-free vulnerability in the pvr2_context_set_notify function. The issue arises from a race condition between threads: setting the disconnect_flag before pvr2_context_disconnect() completes causes memory to be freed while another thread still accesses it.