CVE Vulnerability Catalog

In the Linux kernel, the hwmon (w83791d) driver does not remove optional sysfs files for fans/PWM 4-5 during normal driver removal. Leftover files can lead to access to freed driver data. The fix removes the sysfs group during normal teardown as well.

In the Linux kernel's drm/msm drivers, msm_ringbuffer and msm_gem_vm objects embed a GPU scheduler that is freed with plain kfree(), while userspace can still access the scheduler name via fences. This leads to a use-after-free reachable unprivileged through SYNC_IOC_FILE_INFO. The fix uses kfree_rcu().

In the Linux kernel's SMB client, clean_demultiplex_info() does not cancel reconnect work, which can lead to use-after-free when the demultiplex thread exits. The fix cancels reconnect work before freeing the server.

In the Linux kernel's SMB client, the rlist in TCP_Server_Info is incorrectly initialized (NULL pointers instead of self-referencing), causing list_empty() to always return false and list_add() to dereference NULL. Additionally, a race can occur when cifs_signal_cifsd_for_reconnect() is called concurrently. The fix initializes the list correctly and synchronizes access.

In the Linux kernel SMB client, cifs_try_adding_channels() keeps a pointer to the next interface (niface) across the unlocked window while iface_lock is dropped during cifs_ses_add_channel(). A concurrent interface refresh can free that list entry, leading to a use-after-free when reading iface->rdma_capable/is_active and niface->iface_head.next.

In the Linux kernel SMB client, receive_encrypted_standard() handling of compound encrypted frames has several issues: next_buffer is not cleared after assignment to server->bigbuf (use-after-free risk), pdu_length is not updated to the decrypted plaintext size, next_cmd values smaller than MID_HEADER_SIZE are not rejected, and there is an integer overflow in the upper bound check.

In the Linux kernel SMB client, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual server reply length when snapshot_array_size is smaller than GMT_TOKEN_SIZE. A short reply makes ret_data_len exceed retbuf size, and the subsequent copy_to_user() reads past the end of the buffer.

A vulnerability in the Linux kernel's DRM/TTM subsystem causes swapped-out resources to remain in their bulk_move range, leading to a use-after-free and system crashes. The bug manifests after hibernation or during process exit/reboot.

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation. This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

The BEAR plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can gain unauthorized access to functions or data.

The cloak library from version 0.1.0-pre is vulnerable to bit-flipping attacks on encrypted data. AES-256 encryption in CTR mode lacks integrity checking (MAC), allowing an attacker with write access to the encrypted store to modify data so that it decrypts to a chosen value.

The Fluent Forms Pro Add On Pack plugin versions up to 6.2.13 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. This means an attacker without logging in can inject malicious scripts into the page.

The Progress Planner plugin versions up to 1.10.0 contain a Broken Access Control vulnerability from the subscriber role. This means a low-privileged user can gain unauthorized access to functions or data.

The eLoanApp application contains a SQL injection vulnerability in the POST parameter 'logina' in the endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection.

The Sermon'e plugin versions up to 1.0.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.

The PublishPress Capabilities plugin (capability-manager-enhanced) versions up to 2.45.0 contain an Incorrect Privilege Assignment vulnerability that allows privilege escalation. This means a user can gain higher privileges than intended.

Missing Authorization vulnerability in Easy Digital Downloads allows exploiting incorrectly configured access control security levels. Affects versions through 3.7.1.

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.4.6 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into the page.

The WooCommerce Simple Auctions plugin in versions up to and including 3.0.10 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw allows injection of malicious JavaScript into site pages.

The Video Background Block plugin in versions up to and including 2.0.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw allows injection of malicious scripts into site pages.