CVE Vulnerability Catalog

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.

In the Linux kernel netfilter subsystem, a vulnerability in ctnetlink allowed accepting invalid values for TCP protocol attributes, potentially causing undefined behavior when used as shift counts. The fix replaces manual range and mask validations with netlink policy annotations, rejecting invalid values early.

In the Linux kernel, a vulnerability was found in softleaf_to_folio() in mm/huge_memory.c. Missing memory barrier (smp_rmb) causes a race condition between folio splitting and zap_nonpresent_ptes(), leading to VM_WARN_ON_ONCE or BUG_ON.

W jądrze Linuxa zidentyfikowano podatność, która pozwala na dereferencję wskaźnika NULL w przypadku, gdy użytkownik z uprawnieniami ustawi nr_contexts na 0 podczas działania DAMON. Problem występuje, gdy nie sprawdzono, czy kdamond->contexts->nr == 1 przed dostępem do contexts_arr[0].

W jądrze Linuxa zidentyfikowano podatność, która została rozwiązana. Funkcja damon_sysfs_repeat_call_fn() wywołuje inne funkcje bez sprawdzenia wartości contexts->nr, co może prowadzić do dereferencji wskaźnika NULL, jeśli nr_contexts jest ustawione na 0.

A vulnerability has been identified in the Linux kernel that occurs during the splitting of a PUD entry in the walk_pud_range() function. It may lead to a kernel bug when a thread attempts to read the numa_maps of a process while VFIO-PCI is setting up DMA.

In the Linux kernel, the ext4 filesystem replaces BUG_ON() with proper error handling in ext4_read_inline_folio. When inline data size exceeds PAGE_SIZE, instead of kernel panic, an error is logged, buffer head is released, and -EFSCORRUPTED is returned.

A memory leak vulnerability was found in the Linux kernel's idxd driver during workqueue reset. The issue occurs because the workqueue type is set to NONE before its resources are released.

A flaw was found in binutils, specifically within the `readelf` utility, allowing a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted ELF file. Exploitation can lead to excessive resource consumption or a program crash, making the system unresponsive.

A vulnerability in Spring Security's SubjectX500PrincipalExtractor incorrectly handles malformed CN values in X.509 certificates, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user.

The DeepL Chrome browser extension versions from v1.22.0 to v1.23.0 contain a cross-site scripting vulnerability, allowing an attacker to execute arbitrary scripts in a user's browser and inject malicious HTML into web pages viewed by the user.

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling. Attackers can inject arbitrary SQL expressions via the query= and filter= parameters for integer-mapped DAAP fields.

Vulnerability in the XML Database component of Oracle Database Server allows an unauthenticated attacker remote access via HTTPS to confidential data. It requires user interaction and is difficult to exploit.

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 allows an adjacent attacker on the WLAN to cause a denial-of-service (DoS) condition in the web management interface. The attack requires convincing an authenticated administrator to visit the “AP Select” page while a malformed SSID is present.

A vulnerability in StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 allows an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results they do not have access to.

In the Junrar library prior to version 7.5.10, a path traversal vulnerability in the `LocalFolderExtractor` class allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when extracting a crafted RAR archive.

Vvveb prior to version 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to bypass MIME type validation by prepending a GIF89a header to HTML/JavaScript payloads, then renaming the file to .html extension. This enables arbitrary JavaScript execution in an administrator's browser session, potentially leading to backdoor account creation and malicious plugin uploads for remote code execution.