Archive
2 December 2024
Vulnerabilities first published on this day (UTC), newest first.
199 results · Feed
-
High 7.1
WordPress Advanced What should we write next about plugin <=1.0.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows Stored XSS.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
-
High 8.2
WordPress eDoc Easy Tables plugin <= 1.29 - CSRF to SQL Injection vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affects eDoc Easy Tables: from n/a through <= 1.29.
-
High 8.5
WordPress Watu Quiz plugin <= 3.4.1.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.1.2.
-
High 7.5
net: fix data-races around sk->sk_forward_alloc
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c…
-
Medium 5.5
mptcp: error out earlier on disconnect
In the Linux kernel, the following vulnerability has been resolved: mptcp: error out earlier on disconnect Eric reported a division by zero splat in the MPTCP protocol: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 6094 Comm: syz-exec…
-
High 7.5
mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the …
-
High 7.5
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow In error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add() callback returns error, zone_rule->attr is used uninitiated. Fix it …
-
High 7.8
net/mlx5: fs, lock FTE when checking if active
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, lock FTE when checking if active The referenced commits introduced a two-step process for deleting FTEs: - Lock the FTE, delete it from hardware, set the hardware deletion funct…
-
Unscored —
virtio/vsock: Fix accept_queue memory leak
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may be delayed, it is possible that virtio_transport_recv_listen() will be called after the accept_queue h…
-
Medium 5.5
vsock: Fix sk_error_queue memory leak
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix sk_error_queue memory leak Kernel queues MSG_ZEROCOPY completion notifications on the error queue. Where they remain, until explicitly recv()ed. To prevent memory leaks, clean up t…
-
Medium 5.5
virtio/vsock: Improve MSG_ZEROCOPY error handling
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks.
-
Medium 5.5
drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle The 'vmw_user_object_buffer' function may return NULL with incorrect inputs. To avoid possible null pointer dereferen…
-
Medium 5.5
drm/panthor: Fix handling of partial GPU mapping of BOs
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix handling of partial GPU mapping of BOs This commit fixes the bug in the handling of partial mapping of the buffer objects to the GPU, which caused kernel warnings. Panthor di…
-
Medium 5.5
x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client A number of Zen4 client SoCs advertise the ability to use virtualized VMLOAD/VMSAVE, but using these instructions is reported to be…
-
Unscored —
mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated betwe…
-
Unscored —
ocfs2: uncache inode which has failed entering the group
In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the following BUG: kernel BUG at fs/ocfs2/uptodate.c:509! ... Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e…
-
High 7.1
mm/mremap: fix address wraparound in move_page_tables()
In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in move_page_tables() On 32-bit platforms, it is possible for the expression `len + old_addr < old_end` to be false-positive if `len + old_addr` wraps around…
-
High 7.3
vp_vdpa: fix id_table array not null terminated error
In the Linux kernel, the following vulnerability has been resolved: vp_vdpa: fix id_table array not null terminated error Allocate one extra virtio_device_id as null terminator, otherwise vdpa_mgmtdev_get_classes() may iterate multiple times and visit undefin…
-
High 7.8
nommu: pass NULL argument to vma_iter_prealloc()
In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vma_iter_prealloc() When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to calculate internal state of the tree, but …
-
High 7.3
drm/amd/display: Adjust VSDB parser for replay feature
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adjust VSDB parser for replay feature At some point, the IEEE ID identification for the replay check in the AMD EDID was added. However, this check causes the following out-o…
-
High 7.3
ima: fix buffer overrun in ima_eventdigest_init_common
In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in ima_eventdigest_init_common Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_dig…
-
High 7.8
fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args() The "arg->vec_len" variable is a u64 that comes from the user at the start of the function. The "arg->vec_len * sizeof(st…
-
Medium 5.5
mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
In the Linux kernel, the following vulnerability has been resolved: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() Syzbot reported a bad page state problem caused by a page being freed using free_page() still having a mlocked flag at fr…
-
High 7.1
WordPress April's Call Posts plugin <= 2.1.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in springthistle April's Call Posts aprils-call-posts allows Stored XSS.This issue affects April's Call Posts: from n/a through <= 2.1.1.
-
High 7.1
WordPress WooCommerce Ultimate Gift Card plugin < 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Reflected XSS.This issue affects WooCommerce Ultimate Gift Card: from n/a throu…
-
High 7.7
SQL Injection in WordPress Project Manager Plugin
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.
-
High 7.8
Improper Input Validation in Video Analytics and Processing
Memory corruption while processing API calls to NPU with invalid input.
-
High 7.8
Stack-based Buffer Overflow in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host
Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.
-
High 7.8
Stack-based Buffer Overflow in Performance
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
-
High 7.5
Integer Overflow or Wraparound in WLAN Host Communication
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
-
High 8.4
Buffer Over-read in MProc
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
-
Medium 6.7
Use After Free in Video
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
-
High 8.4
Improper Validation of Array Index in Hypervisor
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
-
Medium 6.7
Untrusted Pointer Dereference in Audio
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
-
Medium 6.1
Buffer Over-read in Neural Processing Unit
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Camera Driver
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
-
High 8.4
Authentication bypass flaw in several mapp components
An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision bef…