CVE Vulnerability Catalog

Podatność w diagnostyce monitorowania zdrowia przełączników Cisco Nexus 3000 i 9000 w trybie NX-OS może pozwolić nieautoryzowanemu, sąsiedniemu atakującemu na nieoczekiwane przeładowanie urządzenia, co prowadzi do stanu odmowy usługi (DoS). Problem wynika z nieprawidłowego przetwarzania określonych ramek Ethernet.

W rozszerzeniu quarkus-resteasy znaleziono błąd, który powoduje wycieki pamięci przy żądaniach klientów z niskimi limitami czasowymi. W przypadku przekroczenia limitu czasu żądania, bufor nie jest poprawnie zwalniany, co prowadzi do zwiększonego zużycia pamięci i ostatecznego awarii aplikacji z powodu błędu OutOfMemoryError.

A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious scripts or HTML via the title field in the article category section.

A cross-site scripting (XSS) vulnerability was found in Emlog Pro version 2.5.4. It allows an attacker to inject malicious JavaScript or HTML code into the article header via the admin panel at /admin/article.php.

In the Linux kernel, the i40e driver has a vulnerability causing a call trace and potentially a system panic. The issue occurs when after a PF reset and ethtool -t, the second i40e_vsi_close starts before the previous one finishes, leading to a crash.

In the Linux kernel, the tun driver has a vulnerability involving a race between tun file and device destruction. NAPIs in struct tun_file can be destroyed before the netdev, and the code does not explicitly delete the NAPI if the queue was detached first.

In the Linux kernel TIPC module, there is a NULL pointer dereference vulnerability. When creating a new node, the broadcast link is created after inserting the node into the hash table, creating a race window where an incoming packet can get the node without the link yet, leading to a kernel panic.

In the Linux kernel, a vulnerability was found in the drm/panfrost driver where calling the madvise IOCTL twice on a BO causes memory shrinker list corruption. This leads to the BO being added to the list twice, causing memory corruption and kernel crash.

In the Linux kernel, the IMA module has a vulnerability involving a potential integer overflow in ima_appraise_measurement. When ima-modsig is enabled, the rc value passed to evm_verifyxattr() may be negative, which can cause an integer overflow.

In the Linux kernel, a buffer overflow vulnerability was found in the be2net driver in the be_get_module_eeprom function. The function be_cmd_read_port_transceiver_data assumes a buffer of sufficient length, which is not always the case, potentially leading to out-of-bounds write.

In the Linux kernel, in the crypto qat module, a parameter check was added for DH to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, in the crypto qat module, a parameter check was added for RSA to reject requests with a source buffer larger than the key size. This prevents a possible integer underflow when copying the scatterlist.

In the Linux kernel, KVM for x86 has a vulnerability in updating guest PTE A/D bits. The use of mapping the PTE into kernel address space is broken for VM_PFNMAP, potentially leading to access to random page frames.

In the Linux kernel, the exFAT filesystem has a vulnerability causing an out-of-bounds read in exfat_clear_bitmap. The issue is triggered by a truncate operation with size 0, leading to memory corruption. The fix adds validation of cluster numbers before using them in bitmap operations.

In the Linux kernel, the Bluetooth hci_qca driver has a vulnerability where del_timer() is used instead of del_timer_sync() before freeing, which can lead to corruption of the timer list. Additionally, the wake_retrans_timer can be rearmed via the work queue.

In the Linux kernel, in the NTFS3 filesystem, validation was added for the sectors_per_clusters field in the BOOT sector. An overly large value can lead to negative shifts or shifts larger than the field size, causing a UBSAN error.

In the Linux kernel, in ALSA USB-audio, when closing a MIDI substream, there might be pending work that accesses the released runtime object. The fix cancels the pending work at closing.

In the Linux kernel, the lpfc (SCSI) driver had a null pointer dereference after failing to issue FLOGI and PLOGI. If FLOGI or PLOGI fails and there is pending dev-loss-evt work, the node may be released prematurely, leading to use-after-free.

In the Linux kernel, the ath11k driver has a buffer overflow vulnerability when processing Wi-Fi scan requests. The maximum number of SSIDs is reported as 16, but the scan_req_params structure can only hold 10, leading to overwriting the extraie pointer. The fix sets the maximum SSID and BSSID counts according to firmware capabilities.

A vulnerability in the Linux kernel's ath10k driver causes a double free crash during system suspend when the driver is in the RESTARTING state after firmware recovery. The issue occurs when a suspend event happens during the restart process, leading to two calls to ath10k_halt() and a kernel panic.