CVE Vulnerability Catalog

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. It may allow a remote attacker to perform a Bleichenbacher-style attack, leading to decryption of RSA ciphertexts.

In the amdgpu driver in the Linux kernel, a potential NULL pointer dereference in amdgpu_ras_query_error_status_helper() was fixed. The function now returns -EINVAL for invalid block IDs.

In the Linux kernel, the Ceph filesystem has an incorrect lock order between a directory entry and its parent, leading to a deadlock or dead code. The fix removes the unused code.

In the Linux kernel, the device tree for Qualcomm sdm845-db845c lacks marking the splash memory region as reserved. This leads to a kernel panic due to an unhandled context fault in arm-smmu.

In the Linux kernel on LoongArch architecture, a vulnerability causes a system panic during initialization when DEFERRED_STRUCT_PAGE_INIT is enabled. The issue stems from incorrect node id assignment to reserved memory blocks, leading to a NULL pointer dereference in reserve_bootmem_region(). The fix assigns all reserved memory blocks to Node#0 during initialization.

In the Linux kernel, the Ceph filesystem fails to drop messages from MDS during unmount, causing inodes to be held with ihold. With encryption enabled, this triggers a warning when removing keys and later a kernel crash when releasing inodes after superblock destruction.

In the Linux kernel, the AMD Display driver (drm/amd/display) did not wake the DMCUB before sending commands, which could cause a system hang. The fix adds waking DMCUB before command submission.

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize metadata on posts containing permalinks under specific conditions, allowing an authenticated attacker to access the contents of individual posts in channels they are not a member of.

Mattermost fails to check the 'invite_guest' permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server.

Mattermost fails to check if compliance export is enabled when fetching posts of public channels, allowing a user who is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.

In the Linux kernel, a workaround for ARM Cortex-A520 erratum 2966298 was added. On affected cores, speculatively executed unprivileged loads might leak data from privileged loads via a cache side channel. The workaround executes a TLBI before returning to EL0.

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress up to version 2.2.0 is vulnerable to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inject arbitrary scripts that execute when a page is visited.

Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict. This issue affects Page Restrict: from n/a through 2.5.5.

The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.

In the Linux kernel, a vulnerability exists involving null pointer dereference in svc_rqst_free() in SUNRPC. When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer is dereferenced when calling put_page() in svc_rqst_free(). The fix adds a null check.

Spoofing vulnerability in Microsoft Edge (Chromium-based). Could allow an attacker to impersonate trusted websites.

A vulnerability in Microsoft Edge (Chromium-based) allows information disclosure.

In the Linux kernel, there is no check that partition length is aligned with the logical block size before adding or resizing a partition. If the disk's logical block size is larger than 512 bytes, the partition size may not be a multiple of the logical block size, leading to I/O errors and, if integrity data is supported, a null pointer dereference in bio_integrity_free.

A flaw in the AMD SPI protection feature allows a user with Ring0 (kernel mode) privileges to bypass protections, potentially resulting in loss of integrity and availability.