CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software allows a malicious authenticated administrator to store a JavaScript payload via the web interface.

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative OS user or an attacker on the same subnet can redirect traffic to an unauthorized server and facilitate malicious software installation. The GlobalProtect app on Linux, Windows, iOS, and GlobalProtect UWP are not affected.

An improper certificate validation vulnerability in the Prisma Access Agent for Android and Chrome OS allows a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information.

Multiple information disclosure vulnerabilities in Prisma Access Agent allow a local user to access sensitive configuration data and credentials. The vulnerability affects the agent on Windows and macOS systems.

An information disclosure vulnerability in Chronosphere Chronocollector allows an unauthenticated attacker with network access to the collector service to retrieve sensitive information.

A race condition vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to bypass certain access and data control policies.

Next.js versions from 10.0.0 to before 15.5.16 and 16.2.5, when self-hosted with the default image loader, do not enforce a maximum size limit for local assets fetched by the Image Optimization API. An attacker can request large files via the /_next/image endpoint, causing out-of-memory conditions.

Podatność w Vercel AI Cloud występuje w wersjach od 50.16.0 do 52.0.0, gdzie w trybie nieinteraktywnym CLI Vercel emituje sugestie dotyczące dalszych działań, które zawierają tokeny uwierzytelniające użytkownika. Tokeny te mogą być przechwycone w logach CI/CD lub innych wynikach automatyzacji.

Aplikacja Claude Desktop w wersjach od 1.2581.0 do przed 1.4304.0 miała lukę w funkcji zdalnego rozwoju SSH, która weryfikowała jedynie istnienie nazwy hosta w pliku ~/.ssh/known_hosts, nie porównując klucza hosta serwera z zapisanym kluczem. To umożliwiało atakującemu w pozycji sieciowej przedstawienie dowolnego klucza hosta SSH, co mogło prowadzić do ataku typu man-in-the-middle na sesje zdalnego rozwoju.

A vulnerability in the urllib3 library for Python (versions 1.23 to 2.7.0) allows leakage of sensitive HTTP headers during cross-origin redirects. The issue occurs when using the low-level API ProxyManager.connection_from_url().urlopen() with assert_same_host=False.

In the Linux kernel, a vulnerability in the liveupdate (LUO) mechanism was found due to improper storage of the retrieve() status in the luo_file structure. On failure, the retrieve flag was not updated, allowing retries and causing errors in the finish() function, potentially leading to data integrity issues.

In the Linux kernel's USB xHCI driver, a vulnerability causes an interrupt storm after a Host Controller Error (HCE) during UAS Storage device plug/unplug on Android devices, leading to severe system faults. The fix adds xhci_halt() in the interrupt handler to stop the controller and break the storm.

In the Linux kernel, a problem was found with the ST1000DM010-2EP102 drive causing random system freezes due to faulty power management (LPM). The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102 which has a similar issue.

In the Linux kernel, a vulnerability was found in the contpte_ptep_set_access_flags() function for ARM64 architecture. The function incorrectly compared the gathered ptep_get() value with the requested entry, which could lead to false no-op detection when only one sub-PTE in a CONT block was updated. As a result, for SMMU units or CPUs without DBM support, an infinite page fault loop could occur.

In the Linux kernel, WARN_ON calls in the nouveau driver during ACPI probing have been removed. These warnings triggered frequently and were considered harmless, so they were dropped.

In the Linux kernel, a vulnerability was found in the MMC subsystem where the 'claimed' and 'retune' control flags shared the same bitfield word. Concurrent writes in asynchronous contexts could overwrite other bits, causing spurious WARN_ON(!host->claimed) warnings. The fix converts these flags to bool type, eliminating unintended read-modify-write (RMW) side effects.

In the Linux kernel, a vulnerability was found in the KVM module for AMD processors (SVM). The issue is that CR8 write interception is not properly cleared when AVIC (Advanced Virtual Interrupt Controller) is activated, leaving it enabled permanently. Combined with another TPR sync bug, this causes the TPR value seen by hardware to become out of sync, which is fatal for Windows virtual machines.

In the Linux kernel, a vulnerability in the sched_ext mechanism where preemption between scx_claim_exit() and helper work kick can cause system wedging. Lack of preemption disabling in this critical code path prevents bypass mode activation and stops task scheduling.

In the Linux kernel, the ASoC driver for AMD ACP3x was missing error checking for clock acquisition. The acp3x_5682_init() function did not verify the result of clk_get(), which could lead to dereferencing error pointers in rt5682_clk_enable().

In the Linux kernel LAN78xx USB Ethernet driver, a redundant netif_napi_del() call was removed from the disconnect path. It triggered a WARN in __netif_napi_del_locked because NAPI was still active. The unregister_netdev() function handles NAPI teardown automatically and safely, so the extra call is unnecessary.