Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: brcmfmac: drain bus_reset work on device removal<br /> <br /> brcmf_fw_crashed() and the debugfs "reset" entry both schedule<br /> drvr-&gt;bus_reset, whose callback recovers drvr through container_of()<br /> and dereferences it. The removal path frees drvr (brcmf_free -&gt;<br /> wiphy_free) without draining the work, so a bus_reset callback pending<br /> or running during removal can outlive drvr.<br /> <br /> Cancellation cannot live in brcmf_detach() or brcmf_free(): the work<br /> callback reaches teardown through the bus .reset op (PCIe<br /> brcmf_pcie_reset -&gt; brcmf_detach; SDIO brcmf_sdio_bus_reset -&gt;<br /> brcmf_sdiod_remove -&gt; brcmf_free), so cancelling there would wait for<br /> the running work and deadlock.<br /> <br /> Add a per-bus mutex (bus_reset_lock) and route all arming through<br /> brcmf_bus_schedule_reset(), which under the lock skips when the bus is<br /> marked removing. Each bus remove entry calls<br /> brcmf_bus_cancel_reset_work(), which under the same lock sets removing<br /> and cancels the work. Holding the mutex across cancel_work_sync() makes<br /> the set-removing + drain step atomic. Every producer reaches the arming<br /> path from process context -- the PCIe firmware-halt notification runs in<br /> the threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail<br /> path runs from the data workqueue -- so the mutex is taken only in<br /> sleepable contexts. Where applicable the remove entry first stops the<br /> firmware-crash producer: on PCIe mask the mailbox and synchronize_irq;<br /> on SDIO unregister the bus interrupt and cancel the data worker, which<br /> also reports firmware halts through brcmf_fw_crashed(). The mutex is<br /> initialized at bus allocation. The SDIO suspend power-off path frees<br /> drvr through the same brcmf_sdiod_remove() and takes the same lock;<br /> resume re-allows the work only on a successful re-probe.<br /> <br /> Also guard brcmf_fw_crashed() against a NULL bus_if/drvr: it can fire<br /> before brcmf_attach() wires up drvr, and it dereferences drvr<br /> (bphy_err/brcmf_dev_coredump) before reaching the arming gate.<br /> <br /> The bus_reset work is shared across buses, so the drain is applied to<br /> every remove path: PCIe (the .reset op introduced by the Fixes commit),<br /> SDIO (arms the same work through brcmf_fw_crashed()), and USB (via the<br /> debugfs "reset" entry). cancel_work_sync() drains a running or pending<br /> bus_reset work item before removal frees drvr, and patch 1/2 makes the<br /> scratch-buffer release safe when reset teardown has already released<br /> those DMA buffers.<br /> <br /> This patch fixes the lifetime of the bus_reset work item itself. It does<br /> not attempt to address the separate, pre-existing lifetime of the<br /> asynchronous firmware completion started by the PCIe reset path. That<br /> callback needs its own lifetime/ownership protocol and is being tracked<br /> separately.<br /> <br /> This issue was found by an in-house static analysis tool.

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.<br /> <br /> Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.<br /> <br /> Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.<br /> <br /> This issue affects eta-otp-lock: before 1.0.4.