CVE Vulnerability Catalog

A vulnerability in the Linux kernel crypto driver for Amlogic SoCs (meson_crypto_probe) causes a double cleanup on allocation failure, leading to a slab-use-after-free in kthread_destroy_worker. This can be triggered by a malicious module or reproducer, potentially causing memory corruption.

In the Linux kernel, the smb2_aead_req_alloc() function has an error code bug: the *num_sgs variable is u32, so ERR_PTR(*num_sgs) does not work correctly. This can lead to returning an invalid error pointer, which when dereferenced causes a system crash.

In the Linux kernel's FUSE-uring subsystem, there are data races on the ring->ready field. On weakly-ordered architectures, the store to fiq->ops can be reordered before the store to ring->ready, potentially leading to use of a stale fiq->ops pointer. Additionally, the fast-path read of ring->ready is unmarked, which KCSAN may flag.

In the Linux kernel's ARC EMAC ethernet driver, there is a vulnerability where interrupts are not quiesced before requesting IRQ. This may allow stale or latched interrupts to be delivered during teardown, leading to a race with net_device release.

In the Linux kernel, the brcmfmac driver has a vulnerability where the bus_reset work item is not drained on device removal, leading to a use-after-free when the work callback runs after the drvr structure is freed.

In the Linux kernel's esd_usb CAN driver, there is a vulnerability where anchored URBs are not killed before freeing netdevs. This causes a use-after-free during device disconnect, as private data is freed before attempting to kill the URBs.

In the Linux kernel's USB gadget f_midi driver, a use-after-free vulnerability exists because the midi->work work item is not canceled before the f_midi object is freed. This allows the work handler to run after memory has been released. The issue was found by an in-house static analysis tool.

In the Broadcom BDC UDC driver in the Linux kernel, there is a use-after-free and NULL pointer dereference vulnerability. Interrupt handling and delayed work can execute after memory structures are freed during driver removal, potentially leading to system crash or code execution.

A SQL injection vulnerability was detected in SourceCodester Computer Repair Shop Management System 1.0 in /classes/Master.php?f=delete_product. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely.

A vulnerability was detected in TinyAGI 0.0.20 in the processMessage function of packages/main/src/index.ts in the Message API Endpoint component. Missing authorization allows remote attack. The exploit is public, and the project has not responded.

A vulnerability was found in TinyAGI 0.0.20 in the collectFiles function of packages/core/src/response.ts in the Message API Endpoint component. This manipulation causes file inclusion. The attack can be initiated remotely, and the exploit is public.

In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Events Manager WordPress plugin before version 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the plugin then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information. This allows unauthenticated attackers to deactivate the plugin's premium licensing state and erase the stored license key.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. This allows unauthenticated users to read published entries of custom post types that the site registered as non-public.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response. This allows unauthenticated users to read the lifetime number of units sold for any published product.