CVE Vulnerability Catalog

A CWE-352 Cross-Site Request Forgery vulnerability was identified in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote unauthenticated attacker can perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.

An SQL Injection vulnerability was identified in the Themeum WP Mega Menu plugin, allowing Blind SQL Injection. This issue affects WP Mega Menu versions from n/a through 1.4.2.

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy.

The WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid, allowing a remote attacker to perform unauthorized actions on the device.

The WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The wnc_maccheck.cgi endpoint is accessible without authentication, allowing a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi passphrase, and technical device information. This issue has been fixed in firmware version 1.1.0.651412.

The WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by only checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel. This issue has been fixed in firmware version 1.1.0.651412.

A bug in the Linux kernel's drm/xe component caused get_flat_ccs_offset() to round the end of usable VRAM upwards, exposing memory belonging to the hardware compression (flat CCS) region to the VRAM allocator as free memory. The compression hardware then overwrote data in that area without the driver's knowledge, corrupting page tables and hanging the compositor (black screen). The issue primarily affects Intel Battlemage G21 hardware.

In the Linux kernel, free_pages_nolock() uses spin_trylock() in NMI context on uniprocessor (UP) systems, which is unsafe. The bug affects the page freeing path and can crash the kernel. It is likely exploitable by local attackers for privilege escalation.

In the Linux kernel USB gadget ffs driver, the io_data structure stores a pointer to the submitting task's mm_struct but does not hold a reference while async requests are pending. This can cause a use-after-free if the task exits before completion handling finishes. The fix takes a reference with mmgrab() when queuing and releases it with mmdrop() on completion.

In the Linux kernel USB gadget f_fs driver, a use-after-free exists in the AIO error path. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but the kiocb cancel function remains armed and points to the freed pointer. A concurrent cancel (e.g., sys_io_cancel()) can cause a use-after-free. The fix safely disarms the cancellation via kiocb->ki_complete() and returns -EIOCBQUEUED.

In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.

In the Linux kernel, the HID sony driver fails to remove a controller from the device list when HID core input device registration fails. The devres-managed sony_sc is freed while its list node remains linked, leading to use-after-free when the next matching controller is handled.

In the Linux kernel, the media: usbtv driver has a use-after-free. ALSA PCM callbacks store driver state in pcm->private_data, and an open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can free struct usbtv before ALSA releases the substream, causing a use-after-free in snd_usbtv_pcm_close().

In the Linux kernel, the usb: dwc3 driver has an issue with the forceRM bit when issuing EndTransfer. On DWC_usb31 v2.00a and v2.10a controllers with forceRM=1, a transfer aborted via ep_dequeue remained active after EndTransfer completion, and a subsequent StartTransfer triggered writes associated with the aborted transfer, causing an SMMU fault because the transfer buffer had already been unmapped. Using forceRM=0 eliminates the issue.

In the Linux kernel, the usb: typec: qcom-pmic-typec driver has an issue with cc_debounce_dwork on stop. cc_debounce_dwork is queued from set_cc() and start_toggling() callbacks, and port_stop() returns before tcpm_unregister_port() destroys the worker. The delayed work can then run after devres has freed pmic_typec_port. The fix uses disable_delayed_work_sync() in port_stop().

In the Linux kernel, the usb: typec: qcom-pmic driver has an issue cancelling reset_work on stop. pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. The fix calls cancel_work_sync() after disabling IRQs.

In the Linux kernel, the usb: typec: ucsi: displayport driver has an out-of-bounds (OOB) altmode array index. The driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The array is UCSI_MAX_ALTMODES elements long, so if the PPM returns an invalid response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an OOB index error.

In the Linux kernel, f_midi2_opts_str_show() in the USB gadget driver has a use-after-free. Callers dereference the opts->info.<field> pointer before taking the lock, racing with f_midi2_opts_str_store(), which frees the old string under the lock. A concurrent attribute write can cause a read of a freed pointer.

The rtw_get_wps_attr() function in the Linux kernel's staging rtl8723bs driver fails to validate the WPS attribute length taken from a wireless management frame. This attacker-controlled length is used unchecked as the size for a memcpy(), causing a heap out-of-bounds read and a stack buffer overflow. The flaw can be triggered by a crafted WPS IE in a beacon or probe response processed during scanning.

In the Linux kernel, the staging rtl8723bs driver's rtw_action_frame_parse() does not check the frame_len parameter before indexing into the frame body. Reading frame_body[0] and frame_body[1] requires frame_len >= 26, so a shorter frame (e.g. 24 bytes) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx().