Vulnerabilidades

*** Pendiente de traducción *** A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy to maintain continuous delivery The project was informed of the problem early through an issue report but has not responded yet.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.

*** Pendiente de traducción *** The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add<br /> <br /> While doing smcr_port_add, there maybe linkgroup add into or delete<br /> from smc_lgr_list.list at the same time, which may result kernel crash.<br /> So, use smc_lgr_list.lock to protect smc_lgr_list.list iterate in<br /> smcr_port_add.<br /> <br /> The crash calltrace show below:<br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> PGD 0 P4D 0<br /> Oops: 0000 [#1] SMP NOPTI<br /> CPU: 0 PID: 559726 Comm: kworker/0:92 Kdump: loaded Tainted: G<br /> Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 449e491 04/01/2014<br /> Workqueue: events smc_ib_port_event_work [smc]<br /> RIP: 0010:smcr_port_add+0xa6/0xf0 [smc]<br /> RSP: 0000:ffffa5a2c8f67de0 EFLAGS: 00010297<br /> RAX: 0000000000000001 RBX: ffff9935e0650000 RCX: 0000000000000000<br /> RDX: 0000000000000010 RSI: ffff9935e0654290 RDI: ffff9935c8560000<br /> RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9934c0401918<br /> R10: 0000000000000000 R11: ffffffffb4a5c278 R12: ffff99364029aae4<br /> R13: ffff99364029aa00 R14: 00000000ffffffed R15: ffff99364029ab08<br /> FS: 0000000000000000(0000) GS:ffff994380600000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 0000000f06a10003 CR4: 0000000002770ef0<br /> PKRU: 55555554<br /> Call Trace:<br /> smc_ib_port_event_work+0x18f/0x380 [smc]<br /> process_one_work+0x19b/0x340<br /> worker_thread+0x30/0x370<br /> ? process_one_work+0x340/0x340<br /> kthread+0x114/0x130<br /> ? __kthread_cancel_work+0x50/0x50<br /> ret_from_fork+0x1f/0x30

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pinctrl: at91-pio4: check return value of devm_kasprintf()<br /> <br /> devm_kasprintf() returns a pointer to dynamically allocated memory.<br /> Pointer could be NULL in case allocation fails. Check pointer validity.<br /> Identified with coccinelle (kmerr.cocci script).<br /> <br /> Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks")<br /> Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int")

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()<br /> <br /> Function amd_pmc_stb_debugfs_open_v2() may be called when the STB<br /> debug mechanism enabled.<br /> <br /> When amd_pmc_send_cmd() fails, the &amp;#39;buf&amp;#39; needs to be released.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> driver core: fix potential null-ptr-deref in device_add()<br /> <br /> I got the following null-ptr-deref report while doing fault injection test:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000058<br /> CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+<br /> RIP: 0010:klist_put+0x2d/0xd0<br /> Call Trace:<br /> <br /> klist_remove+0xf1/0x1c0<br /> device_release_driver_internal+0x196/0x210<br /> bus_remove_device+0x1bd/0x240<br /> device_add+0xd3d/0x1100<br /> w1_add_master_device+0x476/0x490 [wire]<br /> ds2482_probe+0x303/0x3e0 [ds2482]<br /> <br /> This is how it happened:<br /> <br /> w1_alloc_dev()<br /> // The dev-&gt;driver is set to w1_master_driver.<br /> memcpy(&amp;dev-&gt;dev, device, sizeof(struct device));<br /> device_add()<br /> bus_add_device()<br /> dpm_sysfs_add() // It fails, calls bus_remove_device.<br /> <br /> // error path<br /> bus_remove_device()<br /> // The dev-&gt;driver is not null, but driver is not bound.<br /> __device_release_driver()<br /> klist_remove(&amp;dev-&gt;p-&gt;knode_driver) driver is set, in the error path after calling bus_add_device()<br /> in device_add(), bus_remove_device() is called, then the device will be<br /> detached from driver. But device_bind_driver() is not called yet, so it<br /> causes null-ptr-deref while access the &amp;#39;knode_driver&amp;#39;. To fix this, set<br /> dev-&gt;driver to null in the error path before calling bus_remove_device().