CVE Vulnerability Catalog

In the Linux kernel, a deadlock issue related to automatic dump exists in the scsi: hisi_sas driver. When a device goes offline and a 2-bit ECC error occurs simultaneously, the internal abort times out and triggers an automatic dump, which cannot execute because the hisi_hba semaphore is already held, preventing controller reset.

In the Linux kernel's SPI lpspi driver, fsl_lpspi_probe() manually allocates/disposes memory but uses devm_spi_register_controller(). On error after that call, memory is explicitly freed but later used by devm management, leading to use-after-free and NULL pointer dereference.

In the Linux kernel, the hsr_get_node() function has an uninitialized value access issue. This occurs when the Ethernet header packet type is ETH_P_PRP or ETH_P_HSR but is not followed by an HSR tag, causing an invalid sequence number to be read. The fix returns NULL if the Ethernet header is not followed by an HSR tag.

A data race was identified in the Linux kernel's WireGuard module when accessing the receiving_counter.counter field in the keypair structure. The issue was resolved by adding READ_ONCE() and WRITE_ONCE() annotations to mark the race as intentional. The vulnerability was found by Syzkaller with KCSAN.

In the Linux kernel, the bnx2x driver (net/bnx2x) has a race condition during EEH error handling. The functions bnx2x_nic_unload() and bnx2x_io_slot_reset() can concurrently free SGEs, leading to access to freed memory in bnx2x_free_rx_sge() and resulting in a system crash (NULL pointer dereference).

In the Linux kernel, the ice network driver has a NULL pointer dereference in ice_bridge_setlink() if nlmsg_find_attr() returns NULL and br_spec is dereferenced in nla_for_each_nested().

In the Linux kernel for LoongArch architecture, a bug was fixed where cpu_sibling_map was not updated when disabling non-boot CPUs. This caused errors on SMT systems such as 'jump label: negative count!' and kernel warnings. The fix defines and calls clear_cpu_sibling_map().

In the Linux kernel, the netfilter nf_tables module has an issue where the dormant flag is not set again if hook registration fails. This can lead to a table marked as active but with no registered hooks, causing a warning on unregistration.

In the Linux kernel's hv_netvsc driver, if the driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot register the VF because the register call arrives before netvsc_probe finishes. This happens because register_netdevice_notifier() is registered very early, even before vmbus_driver_register(). The fix attempts to register each matching VF at the end of netvsc_probe.

The SiteGround Speed Optimizer WordPress plugin up to version 7.4.6 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.

The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.

The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.

A vulnerability in ZKTeko BioTime version 8.5.4 and earlier allows a remote attacker to obtain sensitive information through the Authentication & Authorization component.

A vulnerability has been identified in the Linux kernel related to null pointer dereference in the ALSA usb-audio module. This issue has been resolved by adding a null check before dereferencing the cs_desc pointer.

In the Linux kernel, the USB Type-C driver (tipd) function tps6598x_block_read triggers a WARN_ON when given an excessive length, potentially causing a system panic if panic-on-warn is enabled.

The Subscribe To Comments Reloaded WordPress plugin (by WPKube) up to version 220725 has a vulnerability that inserts sensitive information into log files, potentially leading to data leakage.

The ConvertKit WordPress plugin up to version 2.4.5 has a vulnerability that inserts sensitive information into log files, potentially leading to data leakage.

A user enumeration vulnerability was found in Portainer CE 2.19.4. During the authentication process, a difference in response time allows a remote unauthenticated attacker to determine if a username is valid.

In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section. When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocations against the .notes section means that the KASLR base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged tools that are expecting to read /sys/kernel/notes, skip performing relocations in the .notes section. The values readable in .notes are then identical to those found in System.map.

A NullPointerException was discovered in Time4J Base v5.9.3 in the FormatUtils::useDefaultWeekmodel(Locale) method. Note: multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.