Vulnerabilities

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe<br /> <br /> The spin lock tx_handling_spinlock in struct m_can_classdev is not<br /> being initialized. This leads the following spinlock bad magic<br /> complaint from the kernel, eg. when trying to send CAN frames with<br /> cansend from can-utils:<br /> <br /> | BUG: spinlock bad magic on CPU#0, cansend/95<br /> | lock: 0xff60000002ec1010, .magic: 00000000, .owner: /-1, .owner_cpu: 0<br /> | CPU: 0 UID: 0 PID: 95 Comm: cansend Not tainted 6.15.0-rc3-00032-ga79be02bba5c #5 NONE<br /> | Hardware name: MachineWare SIM-V (DT)<br /> | Call Trace:<br /> | [] dump_backtrace+0x1c/0x24<br /> | [] show_stack+0x28/0x34<br /> | [] dump_stack_lvl+0x4a/0x68<br /> | [] dump_stack+0x14/0x1c<br /> | [] spin_dump+0x62/0x6e<br /> | [] do_raw_spin_lock+0xd0/0x142<br /> | [] _raw_spin_lock_irqsave+0x20/0x2c<br /> | [] m_can_start_xmit+0x90/0x34a<br /> | [] dev_hard_start_xmit+0xa6/0xee<br /> | [] sch_direct_xmit+0x114/0x292<br /> | [] __dev_queue_xmit+0x3b0/0xaa8<br /> | [] can_send+0xc6/0x242<br /> | [] raw_sendmsg+0x1a8/0x36c<br /> | [] sock_write_iter+0x9a/0xee<br /> | [] vfs_write+0x184/0x3a6<br /> | [] ksys_write+0xa0/0xc0<br /> | [] __riscv_sys_write+0x14/0x1c<br /> | [] do_trap_ecall_u+0x168/0x212<br /> | [] handle_exception+0x146/0x152<br /> <br /> Initializing the spin lock in m_can_class_allocate_dev solves that<br /> problem.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: ucsi: displayport: Fix NULL pointer access<br /> <br /> This patch ensures that the UCSI driver waits for all pending tasks in the<br /> ucsi_displayport_work workqueue to finish executing before proceeding with<br /> the partner removal.

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178.

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7.

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2.