CVE Vulnerability Catalog

A flaw named "EntryBleed" exists in the Linux kernel Page Table Isolation (KPTI). It could allow a local attacker to leak the KASLR base via prefetch side-channels based on TLB timing on Intel systems.

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. Recommended upgrade to Kernel 6.2 or apply relevant stable backports.

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.

An XSS vulnerability in Typora through version 1.3.8 allows an attacker to inject malicious JavaScript via a document containing an SVG element with an attacker-controlled onload attribute. When the exported document is opened by a victim, the code executes in the context of their browser.

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it.

In MISP before version 2.4.167, there is an XSS vulnerability in the template file uploads in app/View/Templates/upload_file.ctp.

A flaw of incorrect access control in the Linux kernel USB core subsystem was found in the way a user attaches a USB device. A local user could use this flaw to crash the system.

A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted. This bug only affects Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 104.

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.

Employee Performance Evaluation System v1.0 was found to have a persistent cross-site scripting (XSS) vulnerability in the Departments and Designations module. An attacker can inject malicious scripts when adding new entries.

W optee_os w TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) przed wersją 3.20 występuje niechroniona operacja dostępu do pamięci, która pozwala fizycznie bliskiemu przeciwnikowi na ominięcie weryfikacji podpisu i zainstalowanie złośliwych aplikacji zaufanych za pomocą wstrzyknięć zakłóceń elektromagnetycznych.

Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

In the Android kernel, in verity_target of dm-verity-target.c, a missing permission check allows modification of read-only files. This could lead to local privilege escalation with System execution privileges. User interaction is not needed.

W Mbed TLS przed wersją 2.28.2 oraz 3.x przed wersją 3.3.0 odkryto problem, który pozwala atakującemu na odzyskanie prywatnego klucza RSA po zaobserwowaniu jednego działania z użyciem klucza prywatnego. Warunkiem jest, aby rozmiar okna (MBEDTLS_MPI_WINDOW_SIZE) używanego do eksponentacji wynosił 3 lub mniej.

In the Linux kernel through 5.16-rc6, the malidp_crtc_reset function in drivers/gpu/drm/arm/malidp_crtc.c does not check the return value of kzalloc(), leading to a null pointer dereference.

In the Linux kernel through 5.16-rc6, the lkdtm_ARRAY_BOUNDS function in drivers/misc/lkdtm/bugs.c does not check the return value of kmalloc(), leading to a null pointer dereference.

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker can inject JavaScript code into the "schedule_job" or "args" parameters in the /resque/delayed/jobs/{schedule_job}?args={args_id} endpoint, leading to client-side script execution.

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.