23139 matches found
f2fs: fix potential deadloop in prepare_compress_overwrite()
...
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
...
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
...
drm/admgpu: fix dereferencing null pointer context
...
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
...
serial: sc16is7xx: fix TX fifo corruption
...
Das U-Boot 2022.01 has a Buffer Overflow.
...
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
...
fs/ntfs3: Fixed overflow check in mi_enum_attr()
...
btrfs: fix deadlock between concurrent dio writes when low on free data space
...
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
...
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.
...
A duplicate <code>SystemPrincipal</code> object could be created when parsing a non-system html document via <code>DOMParser::ParseFromSafeString</code>. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
...
Apache Subversion: Command line argument injection on Windows platforms
...
drm/xe: Fix potential integer overflow in page size calculation
...
drm/amdgpu: fix use-after-free during gpu recovery
...
drm/amdgpu/pm: fix the null pointer while the smu is disabled
...
During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
...
The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 122.
...
drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
...
drm/amd/display: Check stream_status before it is used
...
f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
...
An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.
...
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 8.3.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
...
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
...
VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.
...
btrfs: don't readahead the relocation inode on RST
...
netfs: Only call folio_start_fscache() one time for each folio
...
net: fec: remove .ndo_poll_controller to avoid deadlocks
...
Arbitrary Code Injection
...
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
...
There is a use-after-free at asm/preproc.c (function pp_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service during certain finishes tests.
...
ethtool: fail closed if we can't get max channel used in indirection tables
...
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
...
btrfs: remove BUG() after failure to insert delayed dir index item
...
HDF5 H5Omessage.c H5O_msg_flush heap-based overflow
...
rust openssl ssl::select_next_proto use after free
...
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
...
Stack exhaustion in Decoder.Decode in encoding/gob
...
net: mana: Fix TX CQE error handling
...
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
...
drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
...
scsi: pm80xx: Set phy->enable_completion only when we wait for it
...
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.
...
webpack-dev-middleware Path Traversal vulnerability
...
media: xc2028: avoid use-after-free in load_firmware_cb()
...
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
...
If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
...
drm/amd/display: Wake DMCUB before sending a command
...
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.
...