CVE Vulnerability Catalog

In the Linux kernel's NFS filesystem, there is a potential data corruption vulnerability. During request retransmission, subrequests must be rejoined to the head request, but in some cases they are not, leading to data corruption.

In the Linux kernel, the drm/amdgpu module has an integer overflow in amdgpu_cs_pass1. When size is 0x40000000, multiplying by sizeof(uint32_t) wraps to zero, causing uninitialized memory to be referenced.

A vulnerability in the Linux kernel causes a kernel crash when probing devdax devices on PowerPC with hash translation. The vmemmap optimization for devdax did not account for architecture-specific memory mappings, leading to an invalid data access.

In the Linux kernel, there is an out-of-bounds access vulnerability in ipv6_find_tlv(). The option length (optlen) is fetched without checking if there is more than one byte to parse, which can lead to out-of-bounds access.

In the Linux kernel DRM driver for Meson SoCs (drm/meson), there is a use-after-free vulnerability. When unloading the meson_drm module, component_master_del is not called, leaving the aggregate device on the global list. Reloading the meson_dw_hdmi module dereferences freed memory, triggering a KASAN error.

NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets, and 1.24.2 adds further scrubbing for YXDOMAIN and non-referral nodata replies.

Wtyczka Academy LMS – WordPress LMS Plugin for Complete eLearning Solution jest podatna na eskalację uprawnień we wszystkich wersjach do 3.3.7 włącznie. Problem wynika z niewłaściwej walidacji roli użytkownika przed rejestracją użytkownika za pomocą dodatku Social Login.

The All in One Time Clock Lite plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers with subscriber access and above to clock other users in and out.

Encrypted WiFi and SSH credentials were found in Ghost Robotics Vision 60 v0.27.2 APK. An attacker can connect to the robot's WiFi and view all data, and via SSH gain full control, potentially causing physical damage.

The Ghost Robotics Vision 60 robot version v0.27.2 includes physical interfaces such as three RJ45 connectors and a USB Type-C port, which lack authentication mechanisms when establishing connections. The robot's internal router automatically assigns IP addresses to any physically connected device, and the robot runs on ROS 2 without authentication by default.

The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the robot from any attacking computer or device. The communication protocol used in this interface is based on MAVLink, a widely documented protocol, which increases the likelihood of attack. There are two methods for connecting to the robot remotely: Wi-Fi and 4G/LTE.

Oct8ne Chatbot v2.3 has a Stored XSS vulnerability that allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.

The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rprogress' shortcode in versions up to and including 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.

The SM CountDown Widget plugin for WordPress up to version 1.2 is vulnerable to Stored Cross-Site Scripting via the smcountdown shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ST Categories Widget plugin for WordPress up to version 1.0.0 is vulnerable to Stored Cross-Site Scripting via the st-categories shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Material Design Iconic Font Integration plugin for WordPress up to version 2 is vulnerable to Stored Cross-Site Scripting via the 'mdiconic' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Simple Business Data plugin for WordPress up to version 1.0.1 is vulnerable to Stored Cross-Site Scripting via 'simple_business_data' shortcode attributes. The plugin fails to properly sanitize user input or escape output when embedding the 'type' attribute into the 'class' attribute, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Bg Book Publisher plugin for WordPress up to version 1.25 is vulnerable to Stored Cross-Site Scripting via the 'book_author' post meta rendered through the '[book_author]' shortcode. The plugin fails to properly escape the meta value before output, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Photographers galleries plugin for WordPress up to version 1.1.8 is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes (e.g., 'w', 'h', 'raw_css', 'look'). The plugin fails to properly sanitize user input or escape output when inserting these values into HTML attributes and inline styles, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The WP AD Gallery plugin for WordPress up to version 1.3 is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode. The plugin fails to properly sanitize input and escape output, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.