CVE Vulnerability Catalog

FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This can lead to data disclosure.

A vulnerability in FatFs prior to R0.16, using GPT scanning with 'FF_LBA64 = 1', causes an infinite loop during filesystem mounting. The issue stems from an unbounded loop count derived from the GPTH_PtNum field in the GPT header, leading to extremely long or infinite mount times.

FatFs R0.16 and earlier contains a divide-by-zero bug in exFAT sync logic. Crafted metadata can cause n_fatent - 2 to be zero during write/sync operations, leading to a system crash.

A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc. The flaw is caused by improper input neutralization during web page generation, allowing injection of malicious scripts.

A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc., due to improper input neutralization during web page generation. The issue affects versions from 4.8.2.23 up to 4.8.3.0.

A flaw was found in Foreman that allows authenticated users with 'view_keypairs' permission to download private SSH keys from other organizations by directly querying key pair IDs. This vulnerability bypasses taxonomy scoping, leading to cross-tenant data exposure in multi-tenant deployments.

A flaw was found in Foreman that allows cross-tenant information disclosure. An authenticated user with host-edit permissions can bypass authorization checks and leak sensitive infrastructure metadata from other organizations.

A flaw was found in Foreman where a broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host by modifying the match field through nested host attributes, bypassing authorization checks.

A Cross-site Scripting (XSS) vulnerability was found in MediaWiki in the program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue. The issue is caused by improper neutralization of input during web page generation.

An XSS vulnerability in the Wikimedia Foundation CheckUser extension allows an attacker to inject malicious scripts into a page. The issue is located in the Vue module file responsible for the temporary account blocking field.

An XSS vulnerability in MediaWiki exists in the ApiSandboxLayout.Js file, allowing an attacker to inject malicious scripts into a page. The issue affects versions from 1.46.0-rc.0 before 1.46.0.

Multiple unbounded alloca() calls in the PulseAudio protocol server can lead to stack overflow and potential arbitrary code execution.

The RAOP module accepts unbounded Content-Length values and does not check the return value of pw_array_add().

A vulnerability in the PrivilegedHelperTool XPC service in Cato Client before version 5.13.1 on macOS is caused by improper certificate validation and a TOCTOU race condition. This allows a local authenticated attacker to escalate privileges to root using a self-signed certificate and a symlink swap during package installation.

In the Linux kernel, the WARN_ONCE() in hsr_addr_is_self() has been removed because it triggered a false positive when an HSR interface was being deleted. The self_node pointer is cleared before the network device is fully unregistered, causing an unnecessary warning.

A race condition in the Linux kernel's zap_other_threads() function fails to clear JOBCTL_PENDING_MASK for the calling thread during execve(). This causes a stale stop signal after execve completes, triggering a kernel warning and potential system instability.

A fix in the Linux kernel resolves a warning during core dump on RISC-V. The issue was using the wrong register note type for REGSET_CFI.

In the Linux kernel, a NULL pointer dereference occurs in the wm_adsp driver when removing firmware controls. The wm_adsp_control_remove() function attempts to clean up private data without checking if the priv pointer is NULL.

In the Linux kernel, a vulnerability in netfilter nf_conntrack causes nf_ct_helper_expectfn_unregister() to not remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives, invoking this pointer results in a kernel crash.

A NULL pointer dereference vulnerability was found in the Linux kernel's ASoC SDCA driver during function unregistration. When a function registration fails partially or device cleanup races with probe deferral, func_dev entries may be NULL, causing a kernel oops with BUG message.