CVE Vulnerability Catalog

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

Seclore FileSecure Desktop Client before 3.25.1.0 contains an improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems.

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function.

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

In the Linux kernel, the drm/virtio (virtio-gpu) driver on Xen PV domains incorrectly decides whether to use the DMA API by looking only at the VIRTIO_F_ACCESS_PLATFORM feature bit. Because QEMU does not set iommu_platform on virtio-vga by default, virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host using sg_phys() with guest-physical addresses, which in a PV domain resolve to pages belonging to another domain.

In the Linux kernel, the accel/qaic driver's resp_worker() skips the bounds checking present in decode_message(), which can lead to reading past the end of a slab allocation, infinite loops, or kernel panics. A malformed wire message sent from the device is required for these issues to occur.

In the Linux kernel, the nvme-rdma driver's queue_rq path on -EIO reports a host path error and then still cleans up the command and unmaps the SQE DMA. Because the path error helper completes the request, this results in double cleanup and DMA unmap after the request is already complete.

In the Linux kernel, the BPF subsystem's bpf_map_check_op_flags() compares the CPU ID against num_possible_cpus() instead of nr_cpu_ids and cpu_possible(). With sparse CPU IDs (e.g. mask 0,2-3), invalid CPU 1 is accepted while valid CPU 3 is rejected, leading to a kernel paging fault and panic.

In the Linux kernel, the accel/ethosu driver reads bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION as an activation storage mode, but on U65 the same field holds the rounding mode. This causes valid U65 command streams to fail CMDSTREAM_BO_CREATE with -EINVAL and produces bogus feature map size calculations.

In the Linux kernel, ntfs_attr_find_in_attrdef() in the ntfs driver walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) causes an out-of-bounds read when creating a file.

In the Linux kernel's SCTP_CMD_TIMER_START handling, a TOCTOU race exists: checking timer_pending() before timer_reduce() can allow the timer to expire and detach between these operations. Then timer_reduce() rearms the timer without taking the association reference, leading to an unbalanced reference count and use-after-free during association teardown. The fix uses the return value of timer_reduce() to determine whether the timer was actually armed.

A use-after-free vulnerability exists in the Linux kernel's vxlan_mdb_remote_src_del() function related to VXLAN MDB entry handling. The vxlan_mdb_is_valid_source() function accepts an all-zeros source address, allowing aliasing of (*, G) and (S, G) entry keys, which leads to freeing and then reusing the same memory entry.

In the Linux kernel, a race condition exists in the ALSA subsystem between snd_pcm_mmap_data() and PCM buffer reallocation in snd_pcm_hw_params()/snd_pcm_hw_free(). Because mmap takes no lock, it can map pages of the old buffer that are subsequently freed back to the page allocator, leaving a stale, writable mapping of freed memory (a page-level use-after-free).

In the Linux kernel, ksmbd during logoff did not wait for all channels of an SMB3 multichannel session before freeing shared session objects. Added safe draining that wakes blocked byte-range locks, invokes cancellation callbacks for CANCEL requests, and serializes session teardown with channel registration.

In the Linux kernel, the ksmbd listener thread exits when its listening socket is shut down. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. The fix creates the listener in a stopped state and holds an extra task_struct reference until kthread_stop_put() completes.

In the Linux kernel, Bluetooth L2CAP's l2cap_le_connect_req() left the channel mode at the default, causing FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. This can lead to an out-of-bounds write in l2cap_ecred_rsp_defer(). The fix sets chan->mode correctly and adds a channel mode check with WARN_ON_ONCE instead of an OOB write.

In the Linux kernel, a problem in IPv6 Segment Routing where the network header was not properly restored before routing and forwarding was fixed. Previously, when the SRH did not immediately follow the IPv6 header, the network offset could be negative, potentially leading to buffer overflows during forwarding.

In the Linux kernel, the ASoC fsl_micfil driver's hw_params() and hw_free() enabled and disabled the mclk clock without balancing. The PCM core does not guarantee 1:1 pairing, so hw_free() can run without hw_params(), and hw_params() can be called multiple times, causing an "already disabled" warning or an enable reference leak.

In the Linux kernel's btrfs filesystem, there is a use-after-free vulnerability during RAID stripe insertion. If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. The caller still owns the transaction handle and on error handling ends the transaction again, potentially leading to use-after-free.