Vulnerabilities

A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /manage_website.php. The manipulation of the argument website_image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit_user.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()<br /> <br /> The group variable can&amp;#39;t be used to retrieve ptdev in our second loop,<br /> because it points to the previously iterated list_head, not a valid<br /> group. Get the ptdev object from the scheduler instead.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/panthor: Fix race when converting group handle to group object<br /> <br /> XArray provides it&amp;#39;s own internal lock which protects the internal array<br /> when entries are being simultaneously added and removed. However there<br /> is still a race between retrieving the pointer from the XArray and<br /> incrementing the reference count.<br /> <br /> To avoid this race simply hold the internal XArray lock when<br /> incrementing the reference count, this ensures there cannot be a racing<br /> call to xa_erase().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: qcom: camss: Remove use_count guard in stop_streaming<br /> <br /> The use_count check was introduced so that multiple concurrent Raw Data<br /> Interfaces RDIs could be driven by different virtual channels VCs on the<br /> CSIPHY input driving the video pipeline.<br /> <br /> This is an invalid use of use_count though as use_count pertains to the<br /> number of times a video entity has been opened by user-space not the number<br /> of active streams.<br /> <br /> If use_count and stream-on count don&amp;#39;t agree then stop_streaming() will<br /> break as is currently the case and has become apparent when using CAMSS<br /> with libcamera&amp;#39;s released softisp 0.3.<br /> <br /> The use of use_count like this is a bit hacky and right now breaks regular<br /> usage of CAMSS for a single stream case. Stopping qcam results in the splat<br /> below, and then it cannot be started again and any attempts to do so fails<br /> with -EBUSY.<br /> <br /> [ 1265.509831] WARNING: CPU: 5 PID: 919 at drivers/media/common/videobuf2/videobuf2-core.c:2183 __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]<br /> ...<br /> [ 1265.510630] Call trace:<br /> [ 1265.510636] __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]<br /> [ 1265.510648] vb2_core_streamoff+0x24/0xcc [videobuf2_common]<br /> [ 1265.510660] vb2_ioctl_streamoff+0x5c/0xa8 [videobuf2_v4l2]<br /> [ 1265.510673] v4l_streamoff+0x24/0x30 [videodev]<br /> [ 1265.510707] __video_do_ioctl+0x190/0x3f4 [videodev]<br /> [ 1265.510732] video_usercopy+0x304/0x8c4 [videodev]<br /> [ 1265.510757] video_ioctl2+0x18/0x34 [videodev]<br /> [ 1265.510782] v4l2_ioctl+0x40/0x60 [videodev]<br /> ...<br /> [ 1265.510944] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 0 in active state<br /> [ 1265.511175] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 1 in active state<br /> [ 1265.511398] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 2 in active st<br /> <br /> One CAMSS specific way to handle multiple VCs on the same RDI might be:<br /> <br /> - Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx.<br /> - The video buffers are already associated with msm_vfeN_rdiX so<br /> release video buffers when told to do so by stop_streaming.<br /> - Only release the power-domains for the CSIPHY, CSID and VFE when<br /> their internal refcounts drop.<br /> <br /> Either way refusing to release video buffers based on use_count is<br /> erroneous and should be reverted. The silicon enabling code for selecting<br /> VCs is perfectly fine. Its a "known missing feature" that concurrent VCs<br /> won&amp;#39;t work with CAMSS right now.<br /> <br /> Initial testing with this code didn&amp;#39;t show an error but, SoftISP and "real"<br /> usage with Google Hangouts breaks the upstream code pretty quickly, we need<br /> to do a partial revert and take another pass at VCs.<br /> <br /> This commit partially reverts commit 89013969e232 ("media: camss: sm8250:<br /> Pipeline starting and stopping for multiple virtual channels")

The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of the file /editBranchResult.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&amp;uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tm_ajax.msw request. If the access code was used to create an Administrator account, attackers are also able to register new Administrator accounts with full privileges.

A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip.

A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Doctor/user_appointment.php. The manipulation of the argument schedule_id/schedule_date/schedule_day/start_time/end_time/booking leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.