CVE Vulnerability Catalog

In the Linux kernel's Bluetooth btrtl driver, there is a vulnerability due to improper bounds checking of firmware patches. A too-short patch can cause arithmetic underflow and lead to oversized read/write during Bluetooth setup.

In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.

In the Linux kernel, the mask_user_address() function incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, preventing mask_user_address_isel() from being used on E500 hardware. The fix corrects the check to use the proper name.

In the Linux kernel's cfg80211 subsystem, a vulnerability exists due to missing validation of the EHT MLE type and size before reading the MLD ID. A malicious access point can send a short EHT MLE in an MBSSID beacon, leading to an out-of-bounds read by ieee80211_mle_get_mld_id(). The fix adds validation before the read.

In the Linux kernel, the ieee80211_mle_common_size() function has an issue with validating the common info length in MLE elements. For Reconfiguration and Priority Access types, the length is not correctly checked, potentially leading to improper reads. The fix accounts for the Reconfiguration length and validates the length for all known MLE types.

In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.

In the Linux kernel's mchp23k256 driver for MTD, there is an issue with selecting chip capacity data: the driver uses of_device_get_match_data(), which when matched via SPI id table leads to using default data instead of the correct one. The fix changes to spi_get_device_match_data() to use SPI table data when OF data is absent.

In the Linux kernel's NAND driver lpc32xx_slc, there is an issue with DMA timeout handling: lpc32xx_xmit_dma() ignores the result of wait_for_completion_timeout(), causing a timed-out DMA transfer to be reported as successful. The fix returns -ETIMEDOUT and terminates the DMA channel before unmapping the scatterlist.

In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.

In the Linux kernel, the fwnode_init() function did not initialize all fields of the fwnode_handle structure. If a firmware node is allocated on the stack or heap without zeroing, the secondary pointer may contain uninitialized memory, potentially leading to dereferencing. The fix sets fwnode->secondary to NULL and initializes the remaining fields of the structure.

In the Linux kernel binder module, a vulnerability exists where the LSM context size field is read after being zeroed by release. This inflates the scatter-gather buffer end offset, allowing copies to overwrite the secctx area.

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before version 13.5.7 does not perform an authorization check on one of its REST read routes. This allows unauthenticated users to disclose a store's feed configuration (rules, filters, field mapping) and to enumerate the full product category taxonomy.

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Support Google Consent Mode (GCM)' setting to be enabled.

The MaxUpload plugin for WordPress up to version 1.4.0 is vulnerable to arbitrary file upload via the handle_upload function. Filename validation is inconsistent – extension and MIME checks apply to the uploaded chunk's filename, not to the final assembled filename from the resumableFilename parameter. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

The Propovoice plugin for WordPress up to version 1.7.8 is vulnerable to privilege escalation. The create() function in the REST endpoint fails to validate the role parameter against an allowlist and omits the promote_users capability check, passing the value directly to WP_User::set_role(). Authenticated attackers with ndpv_manager access can create an administrator account.

The Object Sync for Salesforce plugin for WordPress is vulnerable to unauthenticated SQL injection via the wordpress_object_type parameter in the REST route /wp-json/object-sync-for-salesforce/push/. The can_process() function only checks the HTTP method, and the parameter value is directly concatenated into a SQL query. Attackers can inject additional SQL queries, allowing extraction of sensitive data such as password hashes.

The bLoyal plugin for WordPress up to version 3.1.611.78 is vulnerable to privilege escalation. The AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data lack capability and nonce checks, and the bloyal_customer_auto_login function unconditionally trusts the Customer.ExternalId value from the API URL. Authenticated attackers with Subscriber-level access can overwrite the API URL and log in as any user, including administrator.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.