CVE-2025-22022

CVE-2025-22022 concerns the Linux kernel USB xHCI driver, where NEC isochronous endpoints with NEC uPD720200 controllers could trigger IOMMU faults due to mis-handling of missed service errors. The description notes a faulty behavior involving transfer descriptors around isochronous rings and a c...

CVE-2025-22022 usb: xhci: Apply the link chain quirk on NEC isoc endpoints

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 one with start/stop bug, one without were seen to cause IOMMU faults after some Missed Service Errors. Faulting address ...

CVE-2025-22022 usb: xhci: Apply the link chain quirk on NEC isoc endpoints

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 one with start/stop bug, one without were seen to cause IOMMU faults after some Missed Service Errors. Faulting address ...

CVE-2024-34714

The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a critical check for the origin list was...

CVE-2024-56547

In CVE-2024-56547, the Linux kernel’s RCU no-coalescing (nocb) path has a missed barrier on deoffloading, which can trigger a WARN and, in certain racing scenarios, deadlock when rcu_barrier() is invoked on offline CPUs. The vulnerability arises during offline/offloading interactions where multip...

CVE-2024-51406

Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster...

CVE-2024-51406

CVE-2024-51406 affects Floodlight SDN OpenFlow Controller v1.2. The issue enables local hosts to craft fake LLDP packets, causing specific clusters to be missed by Floodlight and resulting in missed hosts both inside and outside the cluster. The vulnerability’s assessment in the provided sources ...

CVE-2024-51406

Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform version 13.2-rc-1 and earlier, which stems from incorrect privilege checking that allows any user who knows the ID of a specific notificatio...

CVE-2023-52751 smb: client: fix use-after-free in smb2_query_info_compound()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

CVE-2023-52751

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

CVE-2023-52751

CVE-2023-52751 : In the Linux kernel CIFS (smb2_query_info_compound), a race between open_cached_dir() and cached_dir_lease_break() can trigger a use-after-free in the cache entry for a newly created directory handle. The issue arises as the code drops the last reference to the new cfid while a l...

CVE-2024-27080 btrfs: fix race when detecting delalloc ranges during fiemap

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap...

CVE-2024-4019 Byzoro Smart S80 Management Platform importhtml.php deserialization

A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has...

Authorization

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed...

CVE-2023-3686 Bylancer QuickAI OpenAI GET Parameter blog sql injection

A vulnerability was found in Bylancer QuickAI OpenAI 3.8.1. It has been declared as critical. This vulnerability affects unknown code of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack can be initiated remotely. The...

SUSE CVE-2016-10728

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the toclient direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection...

SUSE CVE-2021-21333

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject...

Design/Logic Flaw

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation gui...

GSD-2022-1003082 bonding: fix missed rcu protection

bonding: fix missed rcu protection This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit 1b66a533c47d29b38af8e05fbb53b609a5ba3a4e, ...