CVEs

A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS V20 20.0.2.  A specially crafted network request can lead to a denial of service. An attacker can impersonate the legitimate server to trigger this vulnerability.

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it…

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible…

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header…

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using…

A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filter_core/filter_pid.c (L:574-580): function gf_filter_pid_inst_swap_delete_task()…

A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

kubevirt: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification

kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts VMI identity from unauthenticated gRPC request body

Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. In the proof of concept, GPUVictim.app…

kernel: netfilter: nf_queue: hold bridge skb->dev while queued

kernel: batman-adv: v: stop OGMv2 on disabled interface

kernel: batman-adv: fix fragment reassembly length accounting

kernel: netfilter: ip6t_hbh: reject oversized option lists

kernel: batman-adv: frag: disallow unicast fragment in fragment

kernel: sctp: diag: reject stale associations in dump_one path

kernel: Bluetooth: serialize accept_q access

kernel: batman-adv: fix tp_meter counter underflow during shutdown

kernel: netfilter: xt_policy: fix strict mode inbound policy matching

kernel: netfilter: ipset: stop hash:* range iteration at end

kernel: batman-adv: dat: handle forward allocation error

kernel: ipc: limit next_id allocation to the valid ID range

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

kernel: vrf: Fix a potential NPD when removing a port from a VRF

kernel: batman-adv: clear current gateway during teardown

kernel: netfilter: ebtables: fix OOB read in compat_mtw_from_user

kernel: af_unix: Reject SIOCATMARK on non-stream sockets

kernel: sctp: stream: fully roll back denied add-stream state

kernel: ipc/shm: serialize orphan cleanup with shm_nattch updates

kernel: batman-adv: tp_meter: avoid use of uninit sender vars

kernel: xfrm: ipcomp: Free destination pages on acomp errors

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

kernel: batman-adv: tvlv: reject oversized TVLV packets

kernel: xfrm: espintcp: do not reuse an in-progress partial send

kernel: crypto: jitterentropy - replace long-held spinlock with mutex

kernel: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

kernel: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

kernel: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

kernel: tun: zero the whole vnet header in tun_put_user()

kernel: net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

kernel: netfilter: nf_log: validate MAC header was set before dumping it

kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers

kernel: ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

kernel: net: pull headers in qdisc_pkt_len_segs_init()

kernel: wifi: mt76: fix deadlock in remain-on-channel

kernel: md: fix array_state=clear sysfs deadlock