Vulnerabilities

An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries.

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows DOM-Based XSS.This issue affects UltraAddons Elementor Lite: from n/a through

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livemesh Addons for Elementor: from n/a through 8.4.0.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax stax-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor Addons, Widgets and Enhancements – Stax: from n/a through

Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/drm_file: Fix pid refcounting race<br /> <br /> , Maxime Ripard<br /> , Thomas Zimmermann <br /> <br /> filp-&gt;pid is supposed to be a refcounted pointer; however, before this<br /> patch, drm_file_update_pid() only increments the refcount of a struct<br /> pid after storing a pointer to it in filp-&gt;pid and dropping the<br /> dev-&gt;filelist_mutex, making the following race possible:<br /> <br /> process A process B<br /> ========= =========<br /> begin drm_file_update_pid<br /> mutex_lock(&amp;dev-&gt;filelist_mutex)<br /> rcu_replace_pointer(filp-&gt;pid, , 1)<br /> mutex_unlock(&amp;dev-&gt;filelist_mutex)<br /> begin drm_file_update_pid<br /> mutex_lock(&amp;dev-&gt;filelist_mutex)<br /> rcu_replace_pointer(filp-&gt;pid, , 1)<br /> mutex_unlock(&amp;dev-&gt;filelist_mutex)<br /> get_pid()<br /> synchronize_rcu()<br /> put_pid() *** pid B reaches refcount 0 and is freed here ***<br /> get_pid() *** UAF ***<br /> synchronize_rcu()<br /> put_pid()<br /> <br /> As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y<br /> because it requires RCU to detect a quiescent state in code that is not<br /> explicitly calling into the scheduler.<br /> <br /> This race leads to use-after-free of a "struct pid".<br /> It is probably somewhat hard to hit because process A has to pass<br /> through a synchronize_rcu() operation while process B is between<br /> mutex_unlock() and get_pid().<br /> <br /> Fix it by ensuring that by the time a pointer to the current task&amp;#39;s pid<br /> is stored in the file, an extra reference to the pid has been taken.<br /> <br /> This fix also removes the condition for synchronize_rcu(); I think<br /> that optimization is unnecessary complexity, since in that case we<br /> would usually have bailed out on the lockless check above.