CVE Vulnerability Catalog

Concrete CMS below version 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database.

In the Linux kernel, the ibmveth driver has an issue with GSO segmentation for packets with small MSS (below 224 bytes). Attempting to send such packets freezes the adapter, stopping all traffic until manual reset.

In the Linux kernel, the ath12k Wi-Fi driver causes firmware crash on WCN7850 when WoW offloads are enabled on both primary and secondary links in multi-link connections. Fixed by enabling WoW only on the primary link.

In the rt9455 power supply driver in the Linux kernel, there is a use-after-free vulnerability in power_supply_changed(). The order of IRQ and power_supply registration is incorrect, leading to use of a freed pointer.

In the Linux kernel, the NFC HCI SHDLC subsystem fails to stop timers and work before freeing context, leading to use-after-free (UAF) and other shutdown races.

In the Linux kernel, a problem was detected in the RDMA hns driver where during a reset triggered by sunrpc, the hns_roce_irq_workq workqueue is flushed but lacks the WQ_MEM_RECLAIM flag, causing a warning and potential memory allocation issues. The issue occurs during QP destruction, leading to memory leaks.

In the Linux kernel DRM driver for Intel Xe (xe), a vulnerability was found in the sysfs initialization for SR-IOV PF. On devm_add_action_or_reset() failure, the cleanup action was called on an uninitialized kobject, leading to kernel warnings and potential use-after-free. The fix separates kobject_init() and kobject_add() calls and registers the cleanup action only after full kobject initialization.

In the Linux kernel graphics driver (drm/amd/display), an out-of-bounds access vulnerability was found in the stream_enc_regs[] array. The eng_id index can be negative or equal to 5 (ENGINE_ID_DIGF), while the array has only 5 elements (indices 0-4). Missing bounds check before indexing leads to memory access beyond the array.

In the Linux kernel, an out-of-bounds read vulnerability was found in the fib6_add_rt2node() function. The issue occurs when adding an IPv6 route with RTA_NH_ID, where the fib6_info structure lacks the trailing fib6_nh. Missing check of the iter->nh pointer before accessing iter->fib6_nh leads to a KASAN error and potential security compromise.

In the Linux kernel, procfs lacks proper RCU protection when accessing task->real_parent in do_task_stat() while reading /proc/[pid]/stat, leading to a use-after-free (UAF). The fix replaces task_tgid_nr_ns() with task_ppid_nr_ns().

In the Linux kernel, a buffer overflow vulnerability was found in the persistent_ram_save_old() function of the pstore/ram subsystem. The function can be called multiple times for the same zone, and when the buffer size changes between calls, it leads to an out-of-bounds write (OOB write) and subsequent out-of-bounds read (OOB read).

A vulnerability related to the corruption of the dirty_list in the block group tree in the btrfs filesystem has been fixed in the Linux kernel. The issue occurs when the EXTENT_TREE_V2 flag is set, leading to improper addition of elements to the list and potentially causing transaction errors.

In the Linux kernel on MIPS architecture, a bug was found in LLVM compiler that incorrectly restores the $gp register used as a global register variable. After kernel relocation, $gp points to unrelocated code, causing an early crash during CPU initialization.

In the pm8916_lbc power supply driver in the Linux kernel, there is a use-after-free vulnerability in extcon_set_state_sync(). The order of IRQ and extcon registration is incorrect, leading to use of a freed pointer.

In OP-TEE versions 3.16.0 through 4.10.0, a use-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A SPMC/SP flows, where a thread calling sp_mem_remove() without a lock can free objects while another thread dereferences them.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.