CYBR International Malware Information Sharing Platform (MISP)

Cross-Site Request Forgery (CSRF) vulnerability in PPO Vi?t Nam (ppo.vn) PPO Call To Actions allows Cross Site Request Forgery. This issue affects PPO Call To Actions: from n/a through 0.1.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound ARPrice allows Reflected XSS. This issue affects ARPrice: from n/a through 4.0.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Private Messages for UserPro. This issue affects Private Messages for UserPro: from n/a through 4.10.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bonjour Bar allows Stored XSS. This issue affects Bonjour Bar: from n/a through 1.0.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Encoding or Escaping of Output vulnerability in Poll Maker Team Poll Maker. This issue affects Poll Maker: from n/a through n/a.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Fancy Product Designer. This issue affects Fancy Product Designer: from n/a through 6.4.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Incorrect Privilege Assignment vulnerability in NotFound Homey Login Register allows Privilege Escalation. This issue affects Homey Login Register: from n/a through 2.4.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Fancy Product Designer. This issue affects Fancy Product Designer: from n/a through 6.4.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Deserialization of Untrusted Data vulnerability in NotFound ARPrice allows Object Injection. This issue affects ARPrice: from n/a through 4.0.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Private Messages for UserPro allows Reflected XSS. This issue affects Private Messages for UserPro: from n/a through 4.10.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound ARPrice allows SQL Injection. This issue affects ARPrice: from n/a through 4.0.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound ARPrice allows SQL Injection. This issue affects ARPrice: from n/a through 4.0.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows Reflected XSS. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Incorrect Privilege Assignment vulnerability in NotFound Easy Real Estate allows Privilege Escalation. This issue affects Easy Real Estate: from n/a through 2.2.6.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rara Theme UltraLight allows Reflected XSS. This issue affects UltraLight: from n/a through 1.2.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Missing Authorization vulnerability in Eniture Technology Standard Box Sizes – for WooCommerce. This issue affects Standard Box Sizes – for WooCommerce: from n/a through 1.6.13.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Deserialization of Untrusted Data vulnerability in NotFound ARPrice allows Object Injection. This issue affects ARPrice: from n/a through 4.0.3.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Multiple Carousel allows SQL Injection. This issue affects Multiple Carousel: from n/a through 2.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev@tamara.co Tamara Checkout allows Stored XSS. This issue affects Tamara Checkout: from n/a through 1.9.8.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Desk Flexible PDF Coupons allows Stored XSS. This issue affects Flexible PDF Coupons: from n/a through n/a.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TaxoPress WordPress Tag Cloud Plugin – Tag Groups allows Reflected XSS. This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through 2.0.4.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPHocus My auctions allegro allows Reflected XSS. This issue affects My auctions allegro: from n/a through 3.6.18.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms allows Stored XSS. This issue affects MailChimp Subscribe Forms : from n/a through 4.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector allows Stored XSS. This issue affects Ad Blocking Detector: from n/a through 3.6.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Upload a Web Shell to a Web Server. This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.6.7.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E4J s.r.l. VikAppointments Services Booking Calendar allows Stored XSS. This issue affects VikAppointments Services Booking Calendar: from n/a through 1.2.16.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roninwp FAT Event Lite allows Stored XSS. This issue affects FAT Event Lite: from n/a through 1.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Missing Authorization vulnerability in Joe Dolson My Tickets allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects My Tickets: from n/a through 2.0.9.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Team Taskbuilder allows SQL Injection. This issue affects Taskbuilder: from n/a through 3.0.6.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control allows Reflected XSS. This issue affects Image Source Control: from n/a through 2.29.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StoreApps Smart Manager allows Blind SQL Injection. This issue affects Smart Manager: from n/a through 8.52.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D allows Reflected XSS. This issue affects Verge3D: from n/a through 4.8.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's PM callbacks. And the motivation is to drain inflight IOs before suspending. block layer's queue freeze looks very handy, but it is also easy to cause deadlock, such as, any attempt to call into bio_queue_enter() may run into deadlock if the queue is frozen in current context. There are all kinds of ->suspend() called in suspend context, so keeping queue frozen in the whole suspend context isn't one good idea. And Marek reported lockdep warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). [1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ Given the motivation is to drain in-flight IOs, it can be done by calling freeze & unfreeze, meantime restore to previous behavior by keeping queue quiesced during suspend.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex preempt_count: 110001, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234 Hardware name: riscv-virtio,qemu (DT) Call Trace: dump_backtrace+0x1c/0x24 show_stack+0x2c/0x38 dump_stack_lvl+0x5a/0x72 dump_stack+0x14/0x1c __might_resched+0x130/0x13a rt_spin_lock+0x2a/0x5c die+0x24/0x112 do_trap_insn_illegal+0xa0/0xea _new_vmalloc_restore_context_a0+0xcc/0xd8 Oops - illegal instruction [#1] Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled When the caching for a cookie is temporarily disabled (e.g. due to a DIO write on that file), future copying to the cache for that file is disabled until all fds open on that file are closed. However, if netfslib is using the deprecated PG_private_2 method (such as is currently used by ceph), and decides it wants to copy to the cache, netfs_advance_write() will just bail at the first check seeing that the cache stream is unavailable, and indicate that it dealt with all the content. This means that we have no subrequests to provide notifications to drive the state machine or even to pin the request and the request just gets discarded, leaving the folios with PG_private_2 set. Fix this by jumping directly to cancel the request if the cache is not available. That way, we don't remove mark3 from the folio_queue list and netfs_pgpriv2_cancel() will clean up the folios. This was found by running the generic/013 xfstest against ceph with an active cache and the "-o fsc" option passed to ceph. That would usually hang

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At the end of netfs_unlock_read_folio() in which folios are marked appropriately for copying to the cache (either with by being marked dirty and having their private data set or by having PG_private_2 set) and then unlocked, the folio_queue struct has the entry pointing to the folio cleared. This presents a problem for netfs_pgpriv2_write_to_the_cache(), which is used to write folios marked with PG_private_2 to the cache as it expects to be able to trawl the folio_queue list thereafter to find the relevant folios, leading to a hang. Fix this by not clearing the folio_queue entry if we're going to do the deprecated copy-to-cache. The clearance will be done instead as the folios are written to the cache. This can be reproduced by starting cachefiles, mounting a ceph filesystem with "-o fsc" and writing to it.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the new buffer was not zeroed before writing Before writing, if a buffer_head marked as new, its data must be zeroed, otherwise uninitialized data in the page cache will be written. So this commit uses folio_zero_new_buffers() to zero the new buffers before ->write_end().

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_init devm_kasprintf() can return a NULL pointer on failure. A check on the return value of such a call in ads1298_init() is missing. Add it.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue of vmemmap address In sparse vmemmap model, the virtual address of vmemmap is calculated as: ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)). And the struct page's va can be calculated with an offset: (vmemmap + (pfn)). However, when initializing struct pages, kernel actually starts from the first page from the same section that phys_ram_base belongs to. If the first page's physical address is not (phys_ram_base >> PAGE_SHIFT), then we get an va below VMEMMAP_START when calculating va for it's struct page. For example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the first page in the same section is actually pfn 0x80000. During init_unavailable_range(), we will initialize struct page for pfn 0x80000 with virtual address ((struct page *)VMEMMAP_START - 0x2000), which is below VMEMMAP_START as well as PCI_IO_END. This commit fixes this bug by introducing a new variable 'vmemmap_start_pfn' which is aligned with memory section size and using it to calculate vmemmap address instead of phys_ram_base.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang: mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry INFO: task kworker/13:2:4055883 blocked for more than 120 seconds. Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/13:2 D 0 4055883 2 0x00000228 Workqueue: events mlx5e_tx_dim_work [mlx5_core] Call trace: __switch_to+0xe8/0x150 __schedule+0x2a8/0x9b8 schedule+0x2c/0x88 schedule_timeout+0x204/0x478 wait_for_common+0x154/0x250 wait_for_completion+0x28/0x38 cmd_exec+0x7a0/0xa00 [mlx5_core] mlx5_cmd_exec+0x54/0x80 [mlx5_core] mlx5_core_modify_cq+0x6c/0x80 [mlx5_core] mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core] mlx5e_tx_dim_work+0x54/0x68 [mlx5_core] process_one_work+0x1b0/0x448 worker_thread+0x54/0x468 kthread+0x134/0x138 ret_from_fork+0x10/0x18

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes. Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected). This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive. [groeck: Avoid inline variable declaration for portability]

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() scx_ops_bypass() iterates all CPUs to re-enqueue all the scx tasks. For each CPU, it acquires a lock using rq_lock() regardless of whether a CPU is offline or the CPU is currently running a task in a higher scheduler class (e.g., deadline). The rq_lock() is supposed to be used for online CPUs, and the use of rq_lock() may trigger an unnecessary warning in rq_pin_lock(). Therefore, replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass(). Without this change, we observe the following warning: ===== START ===== [ 6.615205] rq->balance_callback && rq->balance_callback != &balance_push_callback [ 6.615208] WARNING: CPU: 2 PID: 0 at kernel/sched/sched.h:1730 __schedule+0x1130/0x1c90 ===== END =====

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid extent tree [BUG] Syzbot reported a crash with the following call trace: BTRFS info (device loop0): scrub: started on devid 1 BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G O 6.13.0-rc4-custom+ #206 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs] Call Trace: scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs] scrub_simple_mirror+0x175/0x260 [btrfs] scrub_stripe+0x5d4/0x6c0 [btrfs] scrub_chunk+0xbb/0x170 [btrfs] scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs] btrfs_scrub_dev+0x240/0x600 [btrfs] btrfs_ioctl+0x1dc8/0x2fa0 [btrfs] ? do_sys_openat2+0xa5/0xf0 __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e [CAUSE] The reproducer is using a corrupted image where extent tree root is corrupted, thus forcing to use "rescue=all,ro" mount option to mount the image. Then it triggered a scrub, but since scrub relies on extent tree to find where the data/metadata extents are, scrub_find_fill_first_stripe() relies on an non-empty extent root. But unfortunately scrub_find_fill_first_stripe() doesn't really expect an NULL pointer for extent root, it use extent_root to grab fs_info and triggered a NULL pointer dereference. [FIX] Add an extra check for a valid extent root at the beginning of scrub_find_fill_first_stripe(). The new error path is introduced by 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots"), but that's pretty old, and later commit b979547513ff ("btrfs: scrub: introduce helper to find and fill sector info for a scrub_stripe") changed how we do scrub. So for kernels older than 6.6, the fix will need manual backport.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked When `ksmbd_vfs_kern_path_locked` met an error and it is not the last entry, it will exit without restoring changed path buffer. But later this buffer may be used as the filename for creation.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure. Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table. Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0. Example dmesg errors when an ethernet cable is connected to MGBE1: [ 116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms [ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter. [ 121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171) [ 121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features [ 121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported [ 121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock [ 121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode [ 125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 181.921404] rcu: 7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [ 181.921684] rcu: (detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [ 181.921878] Sending NMI from CPU 4 to CPUs 7: [ 181.921886] NMI backtrace for cpu 7 [ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6 [ 181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024 [ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 181.922847] pc : handle_softirqs+0x98/0x368 [ 181.922978] lr : __do_softirq+0x18/0x20 [ 181.923095] sp : ffff80008003bf50 [ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [ 181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74 [ 181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1 [ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [ 181.967591] Call trace: [ 181.970043] handle_softirqs+0x98/0x368 (P) [ 181.974240] __do_softirq+0x18/0x20 [ 181.977743] ____do_softirq+0x14/0x28 [ 181.981415] call_on_irq_stack+0x24/0x30 [ 181.985180] do_softirq_own_stack+0x20/0x30 [ 181.989379] __irq_exit_rcu+0x114/0x140 [ 181.993142] irq_exit_rcu+0x14/0x28 [ 181.996816] el1_interrupt+0x44/0xb8 [ 182.000316] el1h_64_irq_handler+0x14/0x20 [ 182.004343] el1h_64_irq+0x80/0x88 [ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P) [ 182.012305] cpuidle_enter+0x3c/0x58 [ 182.015980] cpuidle_idle_call+0x128/0x1c0 [ 182.020005] do_idle+0xe0/0xf0 [ 182.023155] cpu_startup_entry+0x3c/0x48 [ 182.026917] secondary_start_kernel+0xdc/0x120 [ 182.031379] __secondary_switched+0x74/0x78 [ 212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/. [ 212.985935] rcu: blocking rcu_node structures (internal RCU debug): [ 212.992758] Sending NMI from CPU 0 to CPUs 7: [ 212.998539] NMI backtrace for cpu 7 [ 213.004304] CPU: 7 UID: 0 PI ---truncated---

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification. In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu. The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash. Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty. This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array[] In __ftrace_return_to_handler(), a loop iterates over the fgraph_array[] elements, which are fgraph_ops. The loop checks if an element is a fgraph_stub to prevent using a fgraph_stub afterward. However, if the compiler reloads fgraph_array[] after this check, it might race with an update to fgraph_array[] that introduces a fgraph_stub. This could result in the stub being processed, but the stub contains a null "func_hash" field, leading to a NULL pointer dereference. To ensure that the gops compared against the fgraph_stub matches the gops processed later, add a READ_ONCE(). A similar patch appears in commit 63a8dfb ("function_graph: Add READ_ONCE() when accessing fgraph_array[]").

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing. It calls process_string() to handle cases in TP_printk() format that has "%s". It returns whether or not the string is safe. But it can have some false positives. For instance, xe_bo_move() has: TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s", __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size, xe_mem_type_to_name[__entry->old_placement], xe_mem_type_to_name[__entry->new_placement], __get_str(device_id)) Where the "%s" references into xe_mem_type_to_name[]. This is an array of pointers that should be safe for the event to access. Instead of flagging this as a bad reference, if a reference points to an array, where the record field is the index, consider it safe.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false. In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL. The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call, which waits for any RCU critical sections at call-time to complete.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disabling or enabling XSK pools would result in a crash, as the RX queue pointer would be NULL. XSK pool registration will occur as part of the next interface up. Similarly, xsk_wakeup needs be guarded against queues disappearing while the function is executing, so a check against the GVE_PRIV_FLAGS_NAPI_ENABLED flag is added to synchronize with the disabling of the bit and the synchronize_net() in gve_turndown.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower case characters in order to access the application and win prizes as many times as wanted.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to RTR, dip_ctx will not be attached. And during detroying QP, the invalid dip_ctx pointer will be accessed.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: mm: reinstate ability to map write-sealed memfd mappings read-only Patch series "mm: reinstate ability to map write-sealed memfd mappings read-only". In commit 158978945f31 ("mm: perform the mapping_map_writable() check after call_mmap()") (and preceding changes in the same series) it became possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only. Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path behaviour") unintentionally undid this logic by moving the mapping_map_writable() check before the shmem_mmap() hook is invoked, thereby regressing this change. This series reworks how we both permit write-sealed mappings being mapped read-only and disallow mprotect() from undoing the write-seal, fixing this regression. We also add a regression test to ensure that we do not accidentally regress this in future. Thanks to Julian Orth for reporting this regression. This patch (of 2): In commit 158978945f31 ("mm: perform the mapping_map_writable() check after call_mmap()") (and preceding changes in the same series) it became possible to mmap() F_SEAL_WRITE sealed memfd mappings read-only. This was previously unnecessarily disallowed, despite the man page documentation indicating that it would be, thereby limiting the usefulness of F_SEAL_WRITE logic. We fixed this by adapting logic that existed for the F_SEAL_FUTURE_WRITE seal (one which disallows future writes to the memfd) to also be used for F_SEAL_WRITE. For background - the F_SEAL_FUTURE_WRITE seal clears VM_MAYWRITE for a read-only mapping to disallow mprotect() from overriding the seal - an operation performed by seal_check_write(), invoked from shmem_mmap(), the f_op->mmap() hook used by shmem mappings. By extending this to F_SEAL_WRITE and critically - checking mapping_map_writable() to determine if we may map the memfd AFTER we invoke shmem_mmap() - the desired logic becomes possible. This is because mapping_map_writable() explicitly checks for VM_MAYWRITE, which we will have cleared. Commit 5de195060b2e ("mm: resolve faulty mmap_region() error path behaviour") unintentionally undid this logic by moving the mapping_map_writable() check before the shmem_mmap() hook is invoked, thereby regressing this change. We reinstate this functionality by moving the check out of shmem_mmap() and instead performing it in do_mmap() at the point at which VMA flags are being determined, which seems in any case to be a more appropriate place in which to make this determination. In order to achieve this we rework memfd seal logic to allow us access to this information using existing logic and eliminate the clearing of VM_MAYWRITE from seal_check_write() which we are performing in do_mmap() instead.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the application and win prizes as many times as wanted.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.8
• Impact Score: 2.7
• References: , , , , , ,

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , , , ,

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: LOW
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.9
• Impact Score: 1.4
• References: , , ,

In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_show_fdinfo() for an overlayfs watched inode, whose dentry aliases were discarded with drop_caches. The WARN_ON() assertion in inotify_show_fdinfo() was removed, because it is possible for encoding file handle to fail for other reason, but the impact of failing to encode an overlayfs file handle goes beyond this assertion. As shown in the LTP test case mentioned in the link below, failure to encode an overlayfs file handle from a non-aliased inode also leads to failure to report an fid with FAN_DELETE_SELF fanotify events. As Dmitry notes in his analyzis of the problem, ovl_encode_fh() fails if it cannot find an alias for the inode, but this failure can be fixed. ovl_encode_fh() seldom uses the alias and in the case of non-decodable file handles, as is often the case with fanotify fid info, ovl_encode_fh() never needs to use the alias to encode a file handle. Defer finding an alias until it is actually needed so ovl_encode_fh() will not fail in the common case of FAN_DELETE_SELF fanotify events.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing the process.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , ,

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.8
• Impact Score: 2.7
• References: , ,

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: NONE
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.9
• Impact Score: 1.4
• References: , ,

The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.8
• Impact Score: 2.7
• References: , , , ,

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must perform a search and replace action to trigger the exploit.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , ,

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , ,

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: LOW
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.9
• Impact Score: 1.4
• References: , ,

NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

• Vectorstring: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: LOCAL
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.5
• Impact Score: 3.6
• References: ,

Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.

• Vectorstring: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: LOCAL
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: LOW
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.5
• Impact Score: 1.4
• References: ,

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: NONE
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.9
• Impact Score: 1.4
• References: ,

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

• Vectorstring: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: HIGH
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.2
• Impact Score: 3.6
• References: ,

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , , ,

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_especie.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,