Vulnerabilities

SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.

An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arbitrary file creation, modification and deletion.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "next" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place.

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg<br /> <br /> Syzbot reports [1] an uninitialized value issue found by KMSAN in<br /> dib3000_read_reg().<br /> <br /> Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case<br /> that call fails, the buffer may end up with some undefined values.<br /> <br /> Since no elaborate error handling is expected in dib3000_write_reg(),<br /> simply zero out rb buffer to mitigate the problem.<br /> <br /> [1] Syzkaller report<br /> dvb-usb: bulk message failed: -22 (6/0)<br /> =====================================================<br /> BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758<br /> dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758<br /> dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31<br /> dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290<br /> dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]<br /> dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]<br /> dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310<br /> dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110<br /> ...<br /> Local variable rb created at:<br /> dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54<br /> dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758<br /> ...

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mtd: rawnand: fix double free in atmel_pmecc_create_user()<br /> <br /> The "user" pointer was converted from being allocated with kzalloc() to<br /> being allocated by devm_kzalloc(). Calling kfree(user) will lead to a<br /> double free.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset<br /> <br /> The at_xdmac_memset_create_desc may return NULL, which will lead to a<br /> null pointer dereference. For example, the len input is error, or the<br /> atchan-&gt;free_descs_list is empty and memory is exhausted. Therefore, add<br /> check to avoid this.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP<br /> <br /> On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP<br /> disabled can trigger the following bug, as pcpu_hot is unavailable:<br /> <br /> [ 8.471774] BUG: unable to handle page fault for address: 00000000936a290c<br /> [ 8.471849] #PF: supervisor read access in kernel mode<br /> [ 8.471881] #PF: error_code(0x0000) - not-present page<br /> <br /> Fix by inlining a return 0 in the !CONFIG_SMP case.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Prevent bad count for tracing_cpumask_write<br /> <br /> If a large count is provided, it will trigger a warning in bitmap_parse_user.<br /> Also check zero for it.