CVE Vulnerability Catalog

FOSSBilling prior to version 0.8.0 leaks the exact system version through asset cache buster parameters in HTML output, bypassing the hide_version_public security setting.

Cross-Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page.

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file.

A type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world, affecting versions 4.3.0 through 4.11.0. This only applies when configured as an SPMC for S-EL0 SPs.

OP-TEE before version 4.11.0 does not verify that an ECDH public key lies on the correct curve. An attacker in the normal world can send about 30-40 crafted public keys to reconstruct the private key.

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This affects ERPNext version 16.16.0.

ERPNext 16.16.0 allows authenticated users with Item edit permissions to inject arbitrary HTML/JavaScript into item_name, description, or image fields. This code is rendered unescaped in the POS cart interface for every operator adding that item.

Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability in the Z39.50/SRU server configuration. Authenticated attackers can scan internal networks and identify running services by analyzing server response times.

Koha version 25.11 and earlier is vulnerable to XSS via the file upload function in the Invoice module. An attacker can remotely execute arbitrary JavaScript code.

A race condition in the Linux kernel's CoreSight TMC-ETR driver occurs when sysfs and perf modes are used simultaneously, triggering a WARN_ON() when hardware is enabled while the buffer is already initialized by perf mode.

In the Linux kernel pinctrl driver for Canaan K230, a NULL pointer dereference occurs during device tree parsing. The k230_pinctrl_parse_functions() function attempts to access the device pointer via info->pctl_dev->dev, but info->pctl_dev is initialized only after DT parsing completes, causing a crash.

In the Linux kernel PCI P2PDMA subsystem, the p2pmem_alloc_mmap() function uses an incorrect warning condition. After changing the initial page refcount from 1 to 0, the condition VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) falsely triggers a warning when the page has a refcount of 0.

In the Linux kernel, a patch for ASoC fsl_xcvr that attempted to add a missing lock in fsl_xcvr_mode_put() was reverted. The original patch caused a deadlock and hung task because the function is already called with the lock held.

In the Linux kernel, a potential NULL pointer dereference was found in the wpcm_fiu_probe() function of the SPI wpcm-fiu driver. platform_get_resource_byname() can return NULL, causing a crash when passed to resource_size(). The fix moves the fiu->memory_size assignment after the error check for devm_ioremap_resource() to prevent the issue.

In the Linux kernel, the linehandle_create() function has a NULL pointer dereference after calling retain_and_null_ptr(lh). A debug print tries to read from the already nulled pointer, causing a crash.

In the Linux kernel on ARM32 platforms, when SP804 is not registered as sched_clock, read_current_timer() calls sp804_read on an uninitialized sched_clkevt, causing a kernel Oops.

In the Linux kernel, the LOCALIO mechanism (NFS loopback optimization) is vulnerable to recursive deadlock during direct reclaim. Page cache allocations can trigger nfs_writepages, causing a deadlock.

In the Linux kernel fsl-edma DMA driver, the fsl_edma_remove() function manually disables clocks that are already automatically managed by devm_clk_get_enabled(). This triggers warnings on driver removal about attempting to disable an already disabled clock.

In the Linux kernel, the AppArmor module has a vulnerability where DFA (Deterministic Finite Automaton) tables from kernel or userspace are not guaranteed to be 8-byte aligned, causing unaligned memory accesses on various architectures. This triggers warnings and potential kernel panics.