CVE Vulnerability Catalog

Vulnerability in Tenda F451 (versions 1.0.0.7/1.0.0.9) in the fromNatlimit function of the web management interface. Manipulation of the page argument leads to stack-based buffer overflow, enabling remote attack.

Archer MR600 v5 router contains a command injection vulnerability in the WireGuard client configuration via the web management interface. An authenticated attacker with administrative privileges can execute arbitrary commands when applying configuration changes, potentially leading to full compromise of confidentiality, integrity, and availability of the device.

A command injection vulnerability was found in Tenda F451 versions 1.0.0.7 and 1.0.0.9 in the formWriteFacMac function of /goform/WriteFacMac. The attack can be performed remotely. The exploit has been published.

Vulnerability in Tenda HG7, HG9, and HG10 (version 300001138_en_xpon) in the formPPPEdit function. Manipulation of the encodename argument leads to stack-based buffer overflow, enabling remote attack.

Snipe-IT before version 8.6.0 contains a vulnerability that allows a non-admin user with only the granular `users.edit` permission to lock every admin out by editing the `activated` and `ldap_import` flags. Version 8.6.0 contains a patch.

In OpenMetadata prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow and receive cleartext database password and ingestion bot JWT in the HTTP 201 response. The JWT can be reused to access sensitive APIs with bot privileges.

In the Linux kernel, the amdgpu driver fixed an issue with stale wptr mapping access that could lead to a security issue during queue creation.

In the Linux kernel's DRM driver for Intel GPUs (xe), there is missing validation of the PAT index for CPU cached memory. Using XE_COH_NONE coherency mode with CPU cached memory can lead to data leakage.

In the Linux kernel Mediatek pmdomain driver, the function scpsys_get_bus_protection_legacy() calls of_node_put() on a device node before checking for an error from syscon_regmap_lookup_by_phandle(). If an error occurs, dev_err_probe() dereferences the already freed node, leading to a use-after-free vulnerability.

In the Linux kernel, the ath5k driver has an out-of-bounds array access. The index 'ts->ts_final_idx' can be 3 on 5212 hardware, causing a write beyond the 'rates' array of size 4. The issue was reported by UBSAN. The patch adds a check to ensure the index is less than the array size before setting the sentinel.

A vulnerability was found in the Linux kernel's flow_dissector, which mishandles PPPoE frames with Protocol Field Compression (PFC). Sending a crafted PPPoE PFC frame to a network interface on MIPS architecture can cause an unaligned access exception, leading to a system crash.

In the Linux kernel, a vulnerability was found in the NVMe over Fabrics (NVMe-oF) target subsystem where nvmet_ctrl_free() calls flush_work on the same nvmet-wq workqueue, potentially causing a deadlock and triggering a lockdep recursive locking warning.

A vulnerability was found in the Linux kernel's ISO 9660 filesystem (isofs) related to Rock Ridge extension validation. The rock_continue() function reads the extent block number from the CE record without checking if it is within the mounted volume bounds, potentially leading to out-of-range reads or reads from adjacent filesystems. Although no memory safety violation occurs, it may enable information leakage via readlink().

In the Linux kernel topcliff-pch SPI driver, a use-after-free vulnerability occurs during driver unbind. The SPI queue is not flushed before releasing DMA buffers, which can lead to use of already freed memory.

In the Linux kernel HFS+ filesystem, a held lock is freed without release on an error path in hfsplus_fill_super(). The function fails to release tree->tree_lock before jumping to the out_put_root label after a failed hfsplus_cat_build_key() call, triggering a held lock freed warning.

In the Linux kernel, a buffer overflow was found in the retrieve_status function in the dm-ioctl driver. The bug is due to missing overflow check when aligning the outptr pointer to an 8-byte boundary, potentially leading to out-of-bounds write. However, the vulnerability has no security implications because only root can issue device mapper ioctls and libraries use 8-byte aligned buffers.

In the Microchip MPFS-CCC clock driver in the Linux kernel, there is an out-of-bounds access during PLL output registration. The hws array is too small, leading to read/write beyond allocated memory.

In the Linux kernel, a use-after-free (UAF) bug was found in the of_unittest_changeset() function in unit tests. The variable 'parent' points to the same device as 'nchangeset', and calling of_node_put(nchangeset) can free memory that is later accessed by 'parent'. The bug only affects test code but may mask more serious issues.

In the MTD docg3 driver in the Linux kernel, there is a use-after-free vulnerability in docg3_release(). The docg3 pointer is used after memory is freed, leading to a dangling pointer dereference.

In the Linux kernel, a buffer overflow was found in the vrealloc_node_align() function in the vmalloc allocator. When shrinking an allocation (size < old_size), the code copies old_size bytes into the new buffer, causing an out-of-bounds write. The bug was introduced in commit 4c5d3365882d.