CVE Vulnerability Catalog

A buffer overflow vulnerability exists in NetSchedScan 1.0 in the Hostname/IP field. A local attacker can supply a crafted payload of 388 bytes followed by a 4-byte EIP overwrite, causing the application to crash.

Hirschmann HiLCOS products (OpenBAT, BAT450, WLC, BAT867) have a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast traffic when management IP address filtering is disabled, allowing configured filter rules to be bypassed.

In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.

The vulnerability in prompts.chat prior to commit 1464475 allows authenticated users to perform blind server-side request forgery (SSRF) via the inputImageUrl parameter in the Wiro media generator. Attackers can send POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service.

A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.

In the Linux kernel, the atmel-sha204a driver has a ->tfm_count leak when memory allocation fails. The counter is not decremented, potentially blocking future read operations.

In the Linux kernel, a vulnerability was found in the SPI statistics allocation. Per-CPU statistics were not allocated before controller registration, allowing a NULL-pointer dereference when accessing sysfs attributes.

A vulnerability in the Linux kernel's RedBoot partition table parser causes a boot crash. The issue arises from using memcmp() to read beyond the allocated buffer, triggering a buffer overflow warning and oops when FORTIFY_SOURCE is enabled.

In the Linux kernel, a vulnerability in the serial core driver causes an infinite loop in handle_tx() for PORT_UNKNOWN ports. The uart_write_room() function returns a value greater than zero while uart_write() returns 0 when the transmit buffer (xmit_buf) is uninitialized, leading to a system hang.

W jądrze systemu Linux zidentyfikowano podatność, która dotyczy synchronizacji przerwań przed wstrzymaniem GPU. W przypadku, gdy obsługa przerwań jest w toku na innym rdzeniu CPU, może dojść do awarii jądra podczas próby dostępu do rejestrów GPU.

W jądrze Linuxa rozwiązano podatność, która pozwalała na przekazywanie dowolnej liczby wpisów listy BO przez pole bo_number. Wprowadzenie twardego limitu 128 tys. wpisów na listę BO zapobiega atakom na wyczerpanie pamięci oraz zapewnia przewidywalną wydajność.

A race condition was found in the Linux kernel's QBMAN driver for Freescale/NXP SoCs. In qman_destroy_fq, the FQID is released before clearing the fq_table entry, causing a false WARN_ON in qman_create_fq.

A race condition was found in the Linux kernel's power management runtime (PM runtime). The pm_runtime_work() function may dereference the dev->parent pointer after the parent device has been freed, causing a use-after-free. The fix adds a flush_work() call in pm_runtime_remove().

A vulnerability in the Linux kernel's aqc111 USB network driver causes a deadlock during suspend due to improper Power Management (PM) calls. This blocks the entire networking stack, leading to a denial of service.

W jądrze Linuxa rozwiązano podatność polegającą na braku sprawdzenia wartości NULL dla idev w ścieżkach SRv6. Funkcja __in6_dev_get() może zwrócić NULL, gdy urządzenie nie ma konfiguracji IPv6, co może prowadzić do dereferencji wskaźnika NULL.

In the Linux kernel, the udp_sock_create6 function returns success (0) without creating a socket when CONFIG_IPV6 is disabled. This leads to a NULL pointer dereference in callers like fou_create, causing a kernel crash.

In the Linux kernel, the mvpp2 driver vulnerability occurs when mvpp2_bm_switch_buffers() is called without checking if cm3_base pointer is NULL. Missing CM3 SRAM resource in device tree leads to NULL pointer dereference and system crash during MTU change.

Wykryto problem w serwerze MariaDB przed wersją 11.4.10, 11.5.x do 11.8.x przed 11.8.6 oraz 12.x przed 12.2.2. Jeśli zainstalowany jest wtyczka uwierzytelniająca caching_sha2_password, a niektóre konta użytkowników są skonfigurowane do jej używania, duża paczka może spowodować awarię serwera, ponieważ sha256_crypt_r używa alloca.

Podatność XSS w pliku cveInterface.js umożliwia wstrzykiwanie kodu HTML do wyświetlenia, ponieważ cveInterface ufa danym wejściowym z usług API CVE.

A vulnerability in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data by supplying a crafted iu.sh script contained on an SD card.