Instruction: Please provide detailed information about CVE-2025-21632

CVE:CVE-2025-21632
Description:In the Linux kernel, the following vulnerability has been resolved:  x86/fpu: Ensure shadow stack is active before "getting" registers  The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace can not touch them with XSAVE/XRSTOR.  It also means that they are not accessible from the existing ptrace ABI for XSAVE state. Thus, there is a new ptrace get/set interface for it.  The regset code that ptrace uses provides an ->active() handler in addition to the get/set ones. For shadow stack this ->active() handler verifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the thread struct. The ->active() handler is checked from some call sites of the regset get/set handlers, but not the ptrace ones. This was not understood when shadow stack support was put in place.  As a result, both the set/get handlers can be called with XFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to return NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an ssp_active() check to avoid surprising the kernel with shadow stack behavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That check just happened to avoid the warning.  But the ->get() side wasn't so lucky. It can be called with shadow stacks disabled, triggering the warning in practice, as reported by Christina Schimpe:  WARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ? ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0 ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ? do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...]  Ensure that shadow stacks are active in a thread before looking them up in the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are set at the same time, the active check ensures that there will be something to find in the XSAVE buffer.  [ dhansen: changelog/subject tweaks ]
published:2025-01-19T11:15:08.650


Instruction: Please provide detailed information about CVE-2025-21633

CVE:CVE-2025-21633
Description:In the Linux kernel, the following vulnerability has been resolved:  io_uring/sqpoll: zero sqd->thread on tctx errors  Syzkeller reports:  BUG: KASAN: slab-use-after-free in thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341 Read of size 8 at addr ffff88803578c510 by task syz.2.3223/27552  Call Trace:   <TASK>   ...   kasan_report+0x143/0x180 mm/kasan/report.c:602   thread_group_cputime+0x409/0x700 kernel/sched/cputime.c:341   thread_group_cputime_adjusted+0xa6/0x340 kernel/sched/cputime.c:639   getrusage+0x1000/0x1340 kernel/sys.c:1863   io_uring_show_fdinfo+0xdfe/0x1770 io_uring/fdinfo.c:197   seq_show+0x608/0x770 fs/proc/fd.c:68   ...  That's due to sqd->task not being cleared properly in cases where SQPOLL task tctx setup fails, which can essentially only happen with fault injection to insert allocation errors.
published:2025-01-19T11:15:08.773


Instruction: Please provide detailed information about CVE-2025-21634

CVE:CVE-2025-21634
Description:In the Linux kernel, the following vulnerability has been resolved:  cgroup/cpuset: remove kernfs active break  A warning was found:  WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  kernfs_drain+0x15e/0x2f0  __kernfs_remove+0x165/0x300  kernfs_remove_by_name_ns+0x7b/0xc0  cgroup_rm_file+0x154/0x1c0  cgroup_addrm_files+0x1c2/0x1f0  css_clear_dir+0x77/0x110  kill_css+0x4c/0x1b0  cgroup_destroy_locked+0x194/0x380  cgroup_rmdir+0x2a/0x140  It can be explained by: rmdir 				echo 1 > cpuset.cpus 				kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns	kernfs_get_active // active=1 __kernfs_remove					  // active=0x80000002 kernfs_drain			cpuset_write_resmask wait_event //waiting (active == 0x80000001) 				kernfs_break_active_protection 				// active = 0x80000001 // continue 				kernfs_unbreak_active_protection 				// active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs 				kernfs_put_active  This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently.  The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning.  After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'.
published:2025-01-19T11:15:08.890


Instruction: Please provide detailed information about CVE-2025-21635

CVE:CVE-2025-21635
Description:In the Linux kernel, the following vulnerability has been resolved:  rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available).
published:2025-01-19T11:15:09.000


Instruction: Please provide detailed information about CVE-2025-21636

CVE:CVE-2025-21636
Description:In the Linux kernel, the following vulnerability has been resolved:  sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'net' structure can be obtained from the table->data using container_of().  Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.probe_interval' is used.
published:2025-01-19T11:15:09.110


Instruction: Please provide detailed information about CVE-2025-21637

CVE:CVE-2025-21637
Description:In the Linux kernel, the following vulnerability has been resolved:  sctp: sysctl: udp_port: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'net' structure can be obtained from the table->data using container_of().  Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
published:2025-01-19T11:15:09.217


Instruction: Please provide detailed information about CVE-2025-21638

CVE:CVE-2025-21638
Description:In the Linux kernel, the following vulnerability has been resolved:  sctp: sysctl: auth_enable: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'net' structure can be obtained from the table->data using container_of().  Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
published:2025-01-19T11:15:09.317


Instruction: Please provide detailed information about CVE-2025-21639

CVE:CVE-2025-21639
Description:In the Linux kernel, the following vulnerability has been resolved:  sctp: sysctl: rto_min/max: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'net' structure can be obtained from the table->data using container_of().  Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used.
published:2025-01-19T11:15:09.423


Instruction: Please provide detailed information about CVE-2025-21640

CVE:CVE-2025-21640
Description:In the Linux kernel, the following vulnerability has been resolved:  sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy  As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'net' structure can be obtained from the table->data using container_of().  Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used.
published:2025-01-19T11:15:09.537


Instruction: Please provide detailed information about CVE-2025-21641

CVE:CVE-2025-21641
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: sysctl: blackhole timeout: avoid using current->nsproxy  As mentioned in the previous commit, using the 'net' structure via 'current' is not recommended for different reasons:  - Inconsistency: getting info from the reader's/writer's netns vs only   from the opener's netns.  - current->nsproxy can be NULL in some cases, resulting in an 'Oops'   (null-ptr-deref), e.g. when the current task is exiting, as spotted by   syzbot [1] using acct(2).  The 'pernet' structure can be obtained from the table->data using container_of().
published:2025-01-19T11:15:09.643


Instruction: Please provide detailed information about CVE-2025-21642

CVE:CVE-2025-21642
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: sysctl: sched: avoid using current->nsproxy  Using the 'net' structure via 'current' is not recommended for different reasons.  First, if the goal is to use it to read or write per-netns data, this is inconsistent with how the "generic" sysctl entries are doing: directly by only using pointers set to the table entry, e.g. table->data. Linked to that, the per-netns data should always be obtained from the table linked to the netns it had been created for, which may not coincide with the reader's or writer's netns.  Another reason is that access to current->nsproxy->netns can oops if attempted when current->nsproxy had been dropped when the current task is exiting. This is what syzbot found, when using acct(2):    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI   KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]   CPU: 1 UID: 0 PID: 5924 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0   Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024   RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125   Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cc 02 00 00 4d 8b 7c 24 28 48 8d 84 24 c8 00 00   RSP: 0018:ffffc900034774e8 EFLAGS: 00010206    RAX: dffffc0000000000 RBX: 1ffff9200068ee9e RCX: ffffc90003477620   RDX: 0000000000000005 RSI: ffffffff8b08f91e RDI: 0000000000000028   RBP: 0000000000000001 R08: ffffc90003477710 R09: 0000000000000040   R10: 0000000000000040 R11: 00000000726f7475 R12: 0000000000000000   R13: ffffc90003477620 R14: ffffc90003477710 R15: dffffc0000000000   FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007fee3cd452d8 CR3: 000000007d116000 CR4: 00000000003526f0   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400   Call Trace:    <TASK>    proc_sys_call_handler+0x403/0x5d0 fs/proc/proc_sysctl.c:601    __kernel_write_iter+0x318/0xa80 fs/read_write.c:612    __kernel_write+0xf6/0x140 fs/read_write.c:632    do_acct_process+0xcb0/0x14a0 kernel/acct.c:539    acct_pin_kill+0x2d/0x100 kernel/acct.c:192    pin_kill+0x194/0x7c0 fs/fs_pin.c:44    mnt_pin_kill+0x61/0x1e0 fs/fs_pin.c:81    cleanup_mnt+0x3ac/0x450 fs/namespace.c:1366    task_work_run+0x14e/0x250 kernel/task_work.c:239    exit_task_work include/linux/task_work.h:43 [inline]    do_exit+0xad8/0x2d70 kernel/exit.c:938    do_group_exit+0xd3/0x2a0 kernel/exit.c:1087    get_signal+0x2576/0x2610 kernel/signal.c:3017    arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337    exit_to_user_mode_loop kernel/entry/common.c:111 [inline]    exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]    __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]    syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218    do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89    entry_SYSCALL_64_after_hwframe+0x77/0x7f   RIP: 0033:0x7fee3cb87a6a   Code: Unable to access opcode bytes at 0x7fee3cb87a40.   RSP: 002b:00007fffcccac688 EFLAGS: 00000202 ORIG_RAX: 0000000000000037   RAX: 0000000000000000 RBX: 00007fffcccac710 RCX: 00007fee3cb87a6a   RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003   RBP: 0000000000000003 R08: 00007fffcccac6ac R09: 00007fffcccacac7   R10: 00007fffcccac710 R11: 0000000000000202 R12: 00007fee3cd49500   R13: 00007fffcccac6ac R14: 0000000000000000 R15: 00007fee3cd4b000    </TASK>   Modules linked in:   ---[ end trace 0000000000000000 ]---   RIP: 0010:proc_scheduler+0xc6/0x3c0 net/mptcp/ctrl.c:125   Code: 03 42 80 3c 38 00 0f 85 fe 02 00 00 4d 8b a4 24 08 09 00 00 48 b8 00 00 00 00 00 fc ---truncated---
published:2025-01-19T11:15:09.757


Instruction: Please provide detailed information about CVE-2025-21643

CVE:CVE-2025-21643
Description:In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix kernel async DIO  Netfslib needs to be able to handle kernel-initiated asynchronous DIO that is supplied with a bio_vec[] array.  Currently, because of the async flag, this gets passed to netfs_extract_user_iter() which throws a warning and fails because it only handles IOVEC and UBUF iterators.  This can be triggered through a combination of cifs and a loopback blockdev with something like:          mount //my/cifs/share /foo         dd if=/dev/zero of=/foo/m0 bs=4K count=1K         losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0         echo hello >/dev/loop2046  This causes the following to appear in syslog:          WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]  and the write to fail.  Fix this by removing the check in netfs_unbuffered_write_iter_locked() that causes async kernel DIO writes to be handled as userspace writes.  Note that this change relies on the kernel caller maintaining the existence of the bio_vec array (or kvec[] or folio_queue) until the op is complete.
published:2025-01-19T11:15:09.870


Instruction: Please provide detailed information about CVE-2025-21644

CVE:CVE-2025-21644
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/xe: Fix tlb invalidation when wedging  If GuC fails to load, the driver wedges, but in the process it tries to do stuff that may not be initialized yet. This moves the xe_gt_tlb_invalidation_init() to be done earlier: as its own doc says, it's a software-only initialization and should had been named with the _early() suffix.  Move it to be called by xe_gt_init_early(), so the locks and seqno are initialized, avoiding a NULL ptr deref when wedging:  	xe 0000:03:00.0: [drm] *ERROR* GT0: load failed: status: Reset = 0, BootROM = 0x50, UKernel = 0x00, MIA = 0x00, Auth = 0x01 	xe 0000:03:00.0: [drm] *ERROR* GT0: firmware signature verification failed 	xe 0000:03:00.0: [drm] *ERROR* CRITICAL: Xe has declared device 0000:03:00.0 as wedged. 	... 	BUG: kernel NULL pointer dereference, address: 0000000000000000 	#PF: supervisor read access in kernel mode 	#PF: error_code(0x0000) - not-present page 	PGD 0 P4D 0 	Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI 	CPU: 9 UID: 0 PID: 3908 Comm: modprobe Tainted: G     U  W          6.13.0-rc4-xe+ #3 	Tainted: [U]=USER, [W]=WARN 	Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-S ADP-S DDR5 UDIMM CRB, BIOS ADLSFWI1.R00.3275.A00.2207010640 07/01/2022 	RIP: 0010:xe_gt_tlb_invalidation_reset+0x75/0x110 [xe]  This can be easily triggered by poking the GuC binary to force a signature failure. There will still be an extra message,  	xe 0000:03:00.0: [drm] *ERROR* GT0: GuC mmio request 0x4100: no reply 0x4100  but that's better than a NULL ptr deref.  (cherry picked from commit 5001ef3af8f2c972d6fd9c5221a8457556f8bea6)
published:2025-01-19T11:15:09.977


Instruction: Please provide detailed information about CVE-2025-21645

CVE:CVE-2025-21645
Description:In the Linux kernel, the following vulnerability has been resolved:  platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it  Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" for this IRQ will try to drop below zero and there will be an unpleasant WARN() logged:  kernel: atkbd serio0: Disabling IRQ1 wakeup source to avoid platform firmware bug kernel: ------------[ cut here ]------------ kernel: Unbalanced IRQ 1 wake disable kernel: WARNING: CPU: 10 PID: 6431 at kernel/irq/manage.c:920 irq_set_irq_wake+0x147/0x1a0  The PMC driver uses DEFINE_SIMPLE_DEV_PM_OPS() to define its dev_pm_ops which sets amd_pmc_suspend_handler() to the .suspend, .freeze, and .poweroff handlers. i8042_pm_suspend(), however, is only set as the .suspend handler.  Fix the issue by call PMC suspend handler only from the same set of dev_pm_ops handlers as i8042_pm_suspend(), which currently means just the .suspend handler.  To reproduce this issue try hibernating (S4) the machine after a fresh boot without putting it into s2idle first.  [ij: edited the commit message.]
published:2025-01-19T11:15:10.090


Instruction: Please provide detailed information about CVE-2025-21646

CVE:CVE-2025-21646
Description:In the Linux kernel, the following vulnerability has been resolved:  afs: Fix the maximum cell name length  The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning:          WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405  because procfs limits the maximum filename length to 255.  However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL).  Fix this by limiting the maximum acceptable cellname length to 253.  This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.  Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.
published:2025-01-19T11:15:10.197


Instruction: Please provide detailed information about CVE-2025-21647

CVE:CVE-2025-21647
Description:In the Linux kernel, the following vulnerability has been resolved:  sched: sch_cake: add bounds checks to host bulk flow fairness counts  Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access.  To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error).  As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
published:2025-01-19T11:15:10.307


Instruction: Please provide detailed information about CVE-2025-21648

CVE:CVE-2025-21648
Description:In the Linux kernel, the following vulnerability has been resolved:  netfilter: conntrack: clamp maximum hashtable size to INT_MAX  Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:    0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")  Note: hashtable resize is only possible from init_netns.
published:2025-01-19T11:15:10.410


Instruction: Please provide detailed information about CVE-2025-21649


Instruction: Please provide detailed information about CVE-2025-21650

CVE:CVE-2025-21650
Description:In the Linux kernel, the following vulnerability has been resolved:  net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue  The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclge_fetch_pf_reg does not distinguish the tqp space information when reading the tqp space information. When the number of TQPs is greater than 1024, access bar space overwriting occurs. The problem of different segments has been considered during the initialization of tqp.io_base. Therefore, tqp.io_base is directly used when the queue is read in hclge_fetch_pf_reg.  The error message:  Unable to handle kernel paging request at virtual address ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace:  hclge_fetch_pf_reg+0x138/0x250 [hclge]  hclge_get_regs+0x84/0x1d0 [hclge]  hns3_get_regs+0x2c/0x50 [hns3]  ethtool_get_regs+0xf4/0x270  dev_ethtool+0x674/0x8a0  dev_ioctl+0x270/0x36c  sock_do_ioctl+0x110/0x2a0  sock_ioctl+0x2ac/0x530  __arm64_sys_ioctl+0xa8/0x100  invoke_syscall+0x4c/0x124  el0_svc_common.constprop.0+0x140/0x15c  do_el0_svc+0x30/0xd0  el0_svc+0x1c/0x2c  el0_sync_handler+0xb0/0xb4  el0_sync+0x168/0x180
published:2025-01-19T11:15:10.630


Instruction: Please provide detailed information about CVE-2025-21651

CVE:CVE-2025-21651
Description:In the Linux kernel, the following vulnerability has been resolved:  net: hns3: don't auto enable misc vector  Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning like below:  [   16.324639] Call trace: [   16.324641]  __queue_delayed_work+0xb8/0xe0 [   16.324643]  mod_delayed_work_on+0x78/0xd0 [   16.324655]  hclge_errhand_task_schedule+0x58/0x90 [hclge] [   16.324662]  hclge_misc_irq_handle+0x168/0x240 [hclge] [   16.324666]  __handle_irq_event_percpu+0x64/0x1e0 [   16.324667]  handle_irq_event+0x80/0x170 [   16.324670]  handle_fasteoi_edge_irq+0x110/0x2bc [   16.324671]  __handle_domain_irq+0x84/0xfc [   16.324673]  gic_handle_irq+0x88/0x2c0 [   16.324674]  el1_irq+0xb8/0x140 [   16.324677]  arch_cpu_idle+0x18/0x40 [   16.324679]  default_idle_call+0x5c/0x1bc [   16.324682]  cpuidle_idle_call+0x18c/0x1c4 [   16.324684]  do_idle+0x174/0x17c [   16.324685]  cpu_startup_entry+0x30/0x6c [   16.324687]  secondary_start_kernel+0x1a4/0x280 [   16.324688] ---[ end trace 6aa0bff672a964aa ]---  So don't auto enable misc vector when request irq..
published:2025-01-19T11:15:10.733


Instruction: Please provide detailed information about CVE-2025-21652

CVE:CVE-2025-21652
Description:In the Linux kernel, the following vulnerability has been resolved:  ipvlan: Fix use-after-free in ipvlan_get_iflink().  syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch.  ipvlan does not hold a refcnt of the lower device unlike vlan and macvlan.  If the linkwatch work is triggered for the ipvlan dev, the lower dev might have already been freed, resulting in UAF of ipvlan->phy_dev in ipvlan_get_iflink().  We can delay the lower dev unregistration like vlan and macvlan by holding the lower dev's refcnt in dev->netdev_ops->ndo_init() and releasing it in dev->priv_destructor().  Jakub pointed out calling .ndo_XXX after unregister_netdevice() has returned is error prone and suggested [1] addressing this UAF in the core by taking commit 750e51603395 ("net: avoid potential UAF in default_operstate()") further.  Let's assume unregistering devices DOWN and use RCU protection in default_operstate() not to race with the device unregistration.  [0]: BUG: KASAN: slab-use-after-free in ipvlan_get_iflink+0x84/0x88 drivers/net/ipvlan/ipvlan_main.c:353 Read of size 4 at addr ffff0000d768c0e0 by task kworker/u8:35/6944  CPU: 0 UID: 0 PID: 6944 Comm: kworker/u8:35 Not tainted 6.13.0-rc2-g9bc5c9515b48 #12 4c3cb9e8b4565456f6a355f312ff91f4f29b3c47 Hardware name: linux,dummy-virt (DT) Workqueue: events_unbound linkwatch_event Call trace:  show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:484 (C)  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120  print_address_description mm/kasan/report.c:378 [inline]  print_report+0x16c/0x6f0 mm/kasan/report.c:489  kasan_report+0xc0/0x120 mm/kasan/report.c:602  __asan_report_load4_noabort+0x20/0x30 mm/kasan/report_generic.c:380  ipvlan_get_iflink+0x84/0x88 drivers/net/ipvlan/ipvlan_main.c:353  dev_get_iflink+0x7c/0xd8 net/core/dev.c:674  default_operstate net/core/link_watch.c:45 [inline]  rfc2863_policy+0x144/0x360 net/core/link_watch.c:72  linkwatch_do_dev+0x60/0x228 net/core/link_watch.c:175  __linkwatch_run_queue+0x2f4/0x5b8 net/core/link_watch.c:239  linkwatch_event+0x64/0xa8 net/core/link_watch.c:282  process_one_work+0x700/0x1398 kernel/workqueue.c:3229  process_scheduled_works kernel/workqueue.c:3310 [inline]  worker_thread+0x8c4/0xe10 kernel/workqueue.c:3391  kthread+0x2b0/0x360 kernel/kthread.c:389  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862  Allocated by task 9303:  kasan_save_stack mm/kasan/common.c:47 [inline]  kasan_save_track+0x30/0x68 mm/kasan/common.c:68  kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]  __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394  kasan_kmalloc include/linux/kasan.h:260 [inline]  __do_kmalloc_node mm/slub.c:4283 [inline]  __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4289  __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:650  alloc_netdev_mqs+0xb4/0x1118 net/core/dev.c:11209  rtnl_create_link+0x2b8/0xb60 net/core/rtnetlink.c:3595  rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3771  __rtnl_newlink net/core/rtnetlink.c:3896 [inline]  rtnl_newlink+0x122c/0x15c0 net/core/rtnetlink.c:4011  rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6901  netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2542  rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6928  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]  netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1347  netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1891  sock_sendmsg_nosec net/socket.c:711 [inline]  __sock_sendmsg net/socket.c:726 [inline]  __sys_sendto+0x2ec/0x438 net/socket.c:2197  __do_sys_sendto net/socket.c:2204 [inline]  __se_sys_sendto net/socket.c:2200 [inline]  __arm64_sys_sendto+0xe4/0x110 net/socket.c:2200  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]  invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49  el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132  do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151  el ---truncated---
published:2025-01-19T11:15:10.830


Instruction: Please provide detailed information about CVE-2025-21653

CVE:CVE-2025-21653
Description:In the Linux kernel, the following vulnerability has been resolved:  net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute  syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.  UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace:  <TASK>   __dump_stack lib/dump_stack.c:94 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120   ubsan_epilogue lib/ubsan.c:231 [inline]   __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468   flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329   tc_classify include/net/tc_wrapper.h:197 [inline]   __tcf_classify net/sched/cls_api.c:1771 [inline]   tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867   sfb_classify net/sched/sch_sfb.c:260 [inline]   sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318   dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793   __dev_xmit_skb net/core/dev.c:3889 [inline]   __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400   dev_queue_xmit include/linux/netdevice.h:3168 [inline]   neigh_hh_output include/net/neighbour.h:523 [inline]   neigh_output include/net/neighbour.h:537 [inline]   ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236   iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82   udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173   geneve_xmit_skb drivers/net/geneve.c:916 [inline]   geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039   __netdev_start_xmit include/linux/netdevice.h:5002 [inline]   netdev_start_xmit include/linux/netdevice.h:5011 [inline]   xmit_one net/core/dev.c:3590 [inline]   dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606   __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
published:2025-01-19T11:15:10.940


Instruction: Please provide detailed information about CVE-2025-21654

CVE:CVE-2025-21654
Description:In the Linux kernel, the following vulnerability has been resolved:  ovl: support encoding fid from inode with no alias  Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_show_fdinfo() for an overlayfs watched inode, whose dentry aliases were discarded with drop_caches.  The WARN_ON() assertion in inotify_show_fdinfo() was removed, because it is possible for encoding file handle to fail for other reason, but the impact of failing to encode an overlayfs file handle goes beyond this assertion.  As shown in the LTP test case mentioned in the link below, failure to encode an overlayfs file handle from a non-aliased inode also leads to failure to report an fid with FAN_DELETE_SELF fanotify events.  As Dmitry notes in his analyzis of the problem, ovl_encode_fh() fails if it cannot find an alias for the inode, but this failure can be fixed. ovl_encode_fh() seldom uses the alias and in the case of non-decodable file handles, as is often the case with fanotify fid info, ovl_encode_fh() never needs to use the alias to encode a file handle.  Defer finding an alias until it is actually needed so ovl_encode_fh() will not fail in the common case of FAN_DELETE_SELF fanotify events.
published:2025-01-19T11:15:11.040


Instruction: Please provide detailed information about CVE-2025-0575

CVE:CVE-2025-0575
Description:A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the component Rooting Detection. The manipulation leads to protection mechanism failure. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-19T23:15:20.013


Instruction: Please provide detailed information about CVE-2025-0576

CVE:CVE-2025-0576
Description:A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&eventlist&pda&dummy_for_reload=1736177631&p_evt. The manipulation of the argument p_qual leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-20T00:15:16.320


Instruction: Please provide detailed information about CVE-2025-0578

CVE:CVE-2025-0578
Description:A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-20T02:15:18.913


Instruction: Please provide detailed information about CVE-2025-0583

CVE:CVE-2025-0583
Description:The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
published:2025-01-20T02:15:19.767


Instruction: Please provide detailed information about CVE-2025-0579

CVE:CVE-2025-0579
Description:A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-20T03:15:08.353


Instruction: Please provide detailed information about CVE-2025-0580

CVE:CVE-2025-0580
Description:A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/rest_api&action=getOrders of the component REST API Module. The manipulation of the argument contentHash leads to incorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-20T03:15:08.540


Instruction: Please provide detailed information about CVE-2025-0581

CVE:CVE-2025-0581
Description:A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-20T03:15:08.737


Instruction: Please provide detailed information about CVE-2025-0582

CVE:CVE-2025-0582
Description:A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig.php. The manipulation of the argument pigphoto leads to unrestricted upload. The attack can be initiated remotely.
published:2025-01-20T03:15:08.930


Instruction: Please provide detailed information about CVE-2025-0584

CVE:CVE-2025-0584
Description:The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.
published:2025-01-20T03:15:09.120


Instruction: Please provide detailed information about CVE-2025-0585

CVE:CVE-2025-0585
Description:The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
published:2025-01-20T03:15:09.283


Instruction: Please provide detailed information about CVE-2025-0586

CVE:CVE-2025-0586
Description:The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.
published:2025-01-20T03:15:09.433


Instruction: Please provide detailed information about CVE-2025-0590

CVE:CVE-2025-0590
Description:Improper permission settings for mobile applications (com.transsion.carlcare) may lead to   information leakage risk.
published:2025-01-20T07:17:10.383


Instruction: Please provide detailed information about CVE-2025-0479

CVE:CVE-2025-0479
Description:This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.   Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.
published:2025-01-20T12:15:23.563


Instruction: Please provide detailed information about CVE-2025-21655

CVE:CVE-2025-21655
Description:In the Linux kernel, the following vulnerability has been resolved:  io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period  io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev_fd should be deferred another RCU grace period.  Just call io_eventfd_put() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.
published:2025-01-20T14:15:27.027


Instruction: Please provide detailed information about CVE-2025-24337

CVE:CVE-2025-24337
Description:WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.
published:2025-01-20T14:15:27.130


Instruction: Please provide detailed information about CVE-2025-22131

CVE:CVE-2025-22131
Description:PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.
published:2025-01-20T16:15:27.880


Instruction: Please provide detailed information about CVE-2025-22620

CVE:CVE-2025-22620
Description:gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
published:2025-01-20T16:15:28.017


Instruction: Please provide detailed information about CVE-2025-23044

CVE:CVE-2025-23044
Description:PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.
published:2025-01-20T16:15:28.170


Instruction: Please provide detailed information about CVE-2025-23218

CVE:CVE-2025-23218
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_especie.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
published:2025-01-20T16:15:28.317


Instruction: Please provide detailed information about CVE-2025-23219

CVE:CVE-2025-23219
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_cor.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
published:2025-01-20T16:15:28.460


Instruction: Please provide detailed information about CVE-2025-23220

CVE:CVE-2025-23220
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_raca.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
published:2025-01-20T16:15:28.593


Instruction: Please provide detailed information about CVE-2025-24010

CVE:CVE-2025-24010
Description:Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.
published:2025-01-20T16:15:28.730


Instruction: Please provide detailed information about CVE-2025-24013

CVE:CVE-2025-24013
Description:CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.
published:2025-01-20T16:15:28.877


Instruction: Please provide detailed information about CVE-2025-23221

CVE:CVE-2025-23221
Description:Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service. Moreover, this issue can also be maneuvered into performing a Blind SSRF attack. This vulnerability is fixed in 1.0.14, 1.1.11, 1.2.11, and 1.3.4.
published:2025-01-20T17:15:07.987


Instruction: Please provide detailed information about CVE-2025-23214

CVE:CVE-2025-23214
Description:Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7.
published:2025-01-20T18:15:14.127


Instruction: Please provide detailed information about CVE-2025-24014

CVE:CVE-2025-24014
Description:Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.
published:2025-01-20T23:15:07.730


Instruction: Please provide detailed information about CVE-2025-23086

CVE:CVE-2025-23086
Description:On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.
published:2025-01-21T05:15:07.960


Instruction: Please provide detailed information about CVE-2025-0371

CVE:CVE-2025-0371
Description:The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-21T09:15:07.747


Instruction: Please provide detailed information about CVE-2025-23184

CVE:CVE-2025-23184
Description:A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
published:2025-01-21T10:15:08.110


Instruction: Please provide detailed information about CVE-2025-0450

CVE:CVE-2025-0450
Description:The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-21T11:15:10.593


Instruction: Please provide detailed information about CVE-2025-0614

CVE:CVE-2025-0614
Description:Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower case characters in order to access the application and win prizes as many times as wanted.
published:2025-01-21T12:15:27.580


Instruction: Please provide detailed information about CVE-2025-0615

CVE:CVE-2025-0615
Description:Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the application and win prizes as many times as wanted.
published:2025-01-21T12:15:27.737


Instruction: Please provide detailed information about CVE-2025-21656

CVE:CVE-2025-21656
Description:In the Linux kernel, the following vulnerability has been resolved:  hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur  scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes.  Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example if the disk drive was disconnected).  This patch checks scsi_execute_cmd() output and returns -EIO if it's error code is positive.  [groeck: Avoid inline variable declaration for portability]
published:2025-01-21T13:15:09.240


Instruction: Please provide detailed information about CVE-2025-21657

CVE:CVE-2025-21657
Description:In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()  scx_ops_bypass() iterates all CPUs to re-enqueue all the scx tasks. For each CPU, it acquires a lock using rq_lock() regardless of whether a CPU is offline or the CPU is currently running a task in a higher scheduler class (e.g., deadline). The rq_lock() is supposed to be used for online CPUs, and the use of rq_lock() may trigger an unnecessary warning in rq_pin_lock(). Therefore, replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass().  Without this change, we observe the following warning:  ===== START ===== [    6.615205] rq->balance_callback && rq->balance_callback != &balance_push_callback [    6.615208] WARNING: CPU: 2 PID: 0 at kernel/sched/sched.h:1730 __schedule+0x1130/0x1c90 =====  END  =====
published:2025-01-21T13:15:09.340


Instruction: Please provide detailed information about CVE-2025-21658

CVE:CVE-2025-21658
Description:In the Linux kernel, the following vulnerability has been resolved:  btrfs: avoid NULL pointer dereference if no valid extent tree  [BUG] Syzbot reported a crash with the following call trace:    BTRFS info (device loop0): scrub: started on devid 1   BUG: kernel NULL pointer dereference, address: 0000000000000208   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0   Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI   CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206   Tainted: [O]=OOT_MODULE   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022   RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]   Call Trace:    <TASK>    scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]    scrub_simple_mirror+0x175/0x260 [btrfs]    scrub_stripe+0x5d4/0x6c0 [btrfs]    scrub_chunk+0xbb/0x170 [btrfs]    scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]    btrfs_scrub_dev+0x240/0x600 [btrfs]    btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]    ? do_sys_openat2+0xa5/0xf0    __x64_sys_ioctl+0x97/0xc0    do_syscall_64+0x4f/0x120    entry_SYSCALL_64_after_hwframe+0x76/0x7e    </TASK>  [CAUSE] The reproducer is using a corrupted image where extent tree root is corrupted, thus forcing to use "rescue=all,ro" mount option to mount the image.  Then it triggered a scrub, but since scrub relies on extent tree to find where the data/metadata extents are, scrub_find_fill_first_stripe() relies on an non-empty extent root.  But unfortunately scrub_find_fill_first_stripe() doesn't really expect an NULL pointer for extent root, it use extent_root to grab fs_info and triggered a NULL pointer dereference.  [FIX] Add an extra check for a valid extent root at the beginning of scrub_find_fill_first_stripe().  The new error path is introduced by 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots"), but that's pretty old, and later commit b979547513ff ("btrfs: scrub: introduce helper to find and fill sector info for a scrub_stripe") changed how we do scrub.  So for kernels older than 6.6, the fix will need manual backport.
published:2025-01-21T13:15:09.437


Instruction: Please provide detailed information about CVE-2025-21659

CVE:CVE-2025-21659
Description:In the Linux kernel, the following vulnerability has been resolved:  netdev: prevent accessing NAPI instances from another namespace  The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock.  napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().
published:2025-01-21T13:15:09.540


Instruction: Please provide detailed information about CVE-2025-21660

CVE:CVE-2025-21660
Description:In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked  When `ksmbd_vfs_kern_path_locked` met an error and it is not the last entry, it will exit without restoring changed path buffer. But later this buffer may be used as the filename for creation.
published:2025-01-21T13:15:09.643


Instruction: Please provide detailed information about CVE-2025-21661

CVE:CVE-2025-21661
Description:In the Linux kernel, the following vulnerability has been resolved:  gpio: virtuser: fix missing lookup table cleanups  When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure.  Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table.  Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.
published:2025-01-21T13:15:09.747


Instruction: Please provide detailed information about CVE-2025-21662

CVE:CVE-2025-21662
Description:In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix variable not being completed when function returns  When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang:     mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry    INFO: task kworker/13:2:4055883 blocked for more than 120 seconds.          Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.    kworker/13:2    D    0 4055883      2 0x00000228    Workqueue: events mlx5e_tx_dim_work [mlx5_core]    Call trace:       __switch_to+0xe8/0x150       __schedule+0x2a8/0x9b8       schedule+0x2c/0x88       schedule_timeout+0x204/0x478       wait_for_common+0x154/0x250       wait_for_completion+0x28/0x38       cmd_exec+0x7a0/0xa00 [mlx5_core]       mlx5_cmd_exec+0x54/0x80 [mlx5_core]       mlx5_core_modify_cq+0x6c/0x80 [mlx5_core]       mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core]       mlx5e_tx_dim_work+0x54/0x68 [mlx5_core]       process_one_work+0x1b0/0x448       worker_thread+0x54/0x468       kthread+0x134/0x138       ret_from_fork+0x10/0x18
published:2025-01-21T13:15:09.847


Instruction: Please provide detailed information about CVE-2025-21663

CVE:CVE-2025-21663
Description:In the Linux kernel, the following vulnerability has been resolved:  net: stmmac: dwmac-tegra: Read iommu stream id from device tree  Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register.  The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0.  Example dmesg errors when an ethernet cable is connected to MGBE1:  [  116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [  121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms [  121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter. [  121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0 [  121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171) [  121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features [  121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported [  121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock [  121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode [  125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [  181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [  181.921404] rcu: 	7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [  181.921684] rcu: 	(detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [  181.921878] Sending NMI from CPU 4 to CPUs 7: [  181.921886] NMI backtrace for cpu 7 [  181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6 [  181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024 [  181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [  181.922847] pc : handle_softirqs+0x98/0x368 [  181.922978] lr : __do_softirq+0x18/0x20 [  181.923095] sp : ffff80008003bf50 [  181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [  181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [  181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [  181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [  181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [  181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [  181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [  181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74 [  181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1 [  181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [  181.967591] Call trace: [  181.970043]  handle_softirqs+0x98/0x368 (P) [  181.974240]  __do_softirq+0x18/0x20 [  181.977743]  ____do_softirq+0x14/0x28 [  181.981415]  call_on_irq_stack+0x24/0x30 [  181.985180]  do_softirq_own_stack+0x20/0x30 [  181.989379]  __irq_exit_rcu+0x114/0x140 [  181.993142]  irq_exit_rcu+0x14/0x28 [  181.996816]  el1_interrupt+0x44/0xb8 [  182.000316]  el1h_64_irq_handler+0x14/0x20 [  182.004343]  el1h_64_irq+0x80/0x88 [  182.007755]  cpuidle_enter_state+0xc4/0x4a8 (P) [  182.012305]  cpuidle_enter+0x3c/0x58 [  182.015980]  cpuidle_idle_call+0x128/0x1c0 [  182.020005]  do_idle+0xe0/0xf0 [  182.023155]  cpu_startup_entry+0x3c/0x48 [  182.026917]  secondary_start_kernel+0xdc/0x120 [  182.031379]  __secondary_switched+0x74/0x78 [  212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/. [  212.985935] rcu: blocking rcu_node structures (internal RCU debug): [  212.992758] Sending NMI from CPU 0 to CPUs 7: [  212.998539] NMI backtrace for cpu 7 [  213.004304] CPU: 7 UID: 0 PI ---truncated---
published:2025-01-21T13:15:09.947


Instruction: Please provide detailed information about CVE-2025-21664

CVE:CVE-2025-21664
Description:In the Linux kernel, the following vulnerability has been resolved:  dm thin: make get_first_thin use rcu-safe list first function  The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code.  This is because each of these functions performs its own READ_ONCE() of the list head.  This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification.  In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path.  This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself.  The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself.  When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu.  The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash.  Fortunately, the fix here is straight forward.  Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty.  This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
published:2025-01-21T13:15:10.053


Instruction: Please provide detailed information about CVE-2025-22262

CVE:CVE-2025-22262
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bonjour Bar allows Stored XSS. This issue affects Bonjour Bar: from n/a through 1.0.0.
published:2025-01-21T14:15:09.757


Instruction: Please provide detailed information about CVE-2025-22311

CVE:CVE-2025-22311
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Private Messages for UserPro. This issue affects Private Messages for UserPro: from n/a through 4.10.0.
published:2025-01-21T14:15:09.930


Instruction: Please provide detailed information about CVE-2025-22318

CVE:CVE-2025-22318
Description:Missing Authorization vulnerability in Eniture Technology Standard Box Sizes – for WooCommerce. This issue affects Standard Box Sizes – for WooCommerce: from n/a through 1.6.13.
published:2025-01-21T14:15:10.110


Instruction: Please provide detailed information about CVE-2025-22322

CVE:CVE-2025-22322
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Private Messages for UserPro allows Reflected XSS. This issue affects Private Messages for UserPro: from n/a through 4.10.0.
published:2025-01-21T14:15:10.280


Instruction: Please provide detailed information about CVE-2025-22553

CVE:CVE-2025-22553
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Multiple Carousel allows SQL Injection. This issue affects Multiple Carousel: from n/a through 2.0.
published:2025-01-21T14:15:10.453


Instruction: Please provide detailed information about CVE-2025-22706

CVE:CVE-2025-22706
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.
published:2025-01-21T14:15:10.640


Instruction: Please provide detailed information about CVE-2025-22709

CVE:CVE-2025-22709
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D allows Reflected XSS. This issue affects Verge3D: from n/a through 4.8.0.
published:2025-01-21T14:15:10.823


Instruction: Please provide detailed information about CVE-2025-22710

CVE:CVE-2025-22710
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StoreApps Smart Manager allows Blind SQL Injection. This issue affects Smart Manager: from n/a through 8.52.0.
published:2025-01-21T14:15:11.000


Instruction: Please provide detailed information about CVE-2025-22711

CVE:CVE-2025-22711
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control allows Reflected XSS. This issue affects Image Source Control: from n/a through 2.29.0.
published:2025-01-21T14:15:11.173


Instruction: Please provide detailed information about CVE-2025-22716

CVE:CVE-2025-22716
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Team Taskbuilder allows SQL Injection. This issue affects Taskbuilder: from n/a through 3.0.6.
published:2025-01-21T14:15:11.343


Instruction: Please provide detailed information about CVE-2025-22717

CVE:CVE-2025-22717
Description:Missing Authorization vulnerability in Joe Dolson My Tickets allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects My Tickets: from n/a through 2.0.9.
published:2025-01-21T14:15:11.527


Instruction: Please provide detailed information about CVE-2025-22718

CVE:CVE-2025-22718
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roninwp FAT Event Lite allows Stored XSS. This issue affects FAT Event Lite: from n/a through 1.1.
published:2025-01-21T14:15:11.697


Instruction: Please provide detailed information about CVE-2025-22719

CVE:CVE-2025-22719
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E4J s.r.l. VikAppointments Services Booking Calendar allows Stored XSS. This issue affects VikAppointments Services Booking Calendar: from n/a through 1.2.16.
published:2025-01-21T14:15:11.860


Instruction: Please provide detailed information about CVE-2025-22723

CVE:CVE-2025-22723
Description:Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Upload a Web Shell to a Web Server. This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.6.7.
published:2025-01-21T14:15:12.017


Instruction: Please provide detailed information about CVE-2025-22727

CVE:CVE-2025-22727
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms  allows Stored XSS. This issue affects MailChimp Subscribe Forms : from n/a through 4.1.
published:2025-01-21T14:15:12.173


Instruction: Please provide detailed information about CVE-2025-22732

CVE:CVE-2025-22732
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector allows Stored XSS. This issue affects Ad Blocking Detector: from n/a through 3.6.0.
published:2025-01-21T14:15:12.387


Instruction: Please provide detailed information about CVE-2025-22733

CVE:CVE-2025-22733
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPHocus My auctions allegro allows Reflected XSS. This issue affects My auctions allegro: from n/a through 3.6.18.
published:2025-01-21T14:15:12.570


Instruction: Please provide detailed information about CVE-2025-22735

CVE:CVE-2025-22735
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TaxoPress WordPress Tag Cloud Plugin – Tag Groups allows Reflected XSS. This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through 2.0.4.
published:2025-01-21T14:15:12.737


Instruction: Please provide detailed information about CVE-2025-22763

CVE:CVE-2025-22763
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.
published:2025-01-21T14:15:12.900


Instruction: Please provide detailed information about CVE-2025-22825

CVE:CVE-2025-22825
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Desk Flexible PDF Coupons allows Stored XSS. This issue affects Flexible PDF Coupons: from n/a through n/a.
published:2025-01-21T14:15:13.060


Instruction: Please provide detailed information about CVE-2025-23997

CVE:CVE-2025-23997
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev@tamara.co Tamara Checkout allows Stored XSS. This issue affects Tamara Checkout: from n/a through 1.9.8.
published:2025-01-21T14:15:13.230


Instruction: Please provide detailed information about CVE-2025-23998

CVE:CVE-2025-23998
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rara Theme UltraLight allows Reflected XSS. This issue affects UltraLight: from n/a through 1.2.
published:2025-01-21T14:15:13.413


Instruction: Please provide detailed information about CVE-2025-24001

CVE:CVE-2025-24001
Description:Cross-Site Request Forgery (CSRF) vulnerability in PPO Việt Nam (ppo.vn) PPO Call To Actions allows Cross Site Request Forgery. This issue affects PPO Call To Actions: from n/a through 0.1.3.
published:2025-01-21T14:15:13.600


Instruction: Please provide detailed information about CVE-2025-0377

CVE:CVE-2025-0377
Description:HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
published:2025-01-21T16:15:14.290


Instruction: Please provide detailed information about CVE-2025-24011

CVE:CVE-2025-24011
Description:Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.
published:2025-01-21T16:15:14.760


Instruction: Please provide detailed information about CVE-2025-24012

CVE:CVE-2025-24012
Description:Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.
published:2025-01-21T16:15:14.923


Instruction: Please provide detailed information about CVE-2025-24017

CVE:CVE-2025-24017
Description:YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
published:2025-01-21T16:15:15.087


Instruction: Please provide detailed information about CVE-2025-0623

CVE:CVE-2025-0623
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-21T17:15:16.817


Instruction: Please provide detailed information about CVE-2025-24018

CVE:CVE-2025-24018
Description:YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the content edition feature and more specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached using the `{{attach}}` component, if the resource contained in the `file` attribute doesn't exist, then the server will generate a file upload button containing the filename. This vulnerability allows any malicious authenticated user that has the right to create a comment or edit a page to be able to steal accounts and therefore modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
published:2025-01-21T17:15:16.917


Instruction: Please provide detailed information about CVE-2025-22150

CVE:CVE-2025-22150
Description:Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
published:2025-01-21T18:15:14.887


Instruction: Please provide detailed information about CVE-2025-22267

CVE:CVE-2025-22267
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Wampler Weaver Themes Shortcode Compatibility allows Stored XSS. This issue affects Weaver Themes Shortcode Compatibility: from n/a through 1.0.4.
published:2025-01-21T18:15:15.100


Instruction: Please provide detailed information about CVE-2025-22276

CVE:CVE-2025-22276
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enguerran Weiss Related Post Shortcode allows Stored XSS. This issue affects Related Post Shortcode: from n/a through 1.2.
published:2025-01-21T18:15:15.303


Instruction: Please provide detailed information about CVE-2025-22661

CVE:CVE-2025-22661
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita.com Online Payments – Get Paid with PayPal, Square & Stripe allows Stored XSS. This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through 3.20.0.
published:2025-01-21T18:15:15.707


Instruction: Please provide detailed information about CVE-2025-22721

CVE:CVE-2025-22721
Description:Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.6.7.1.
published:2025-01-21T18:15:15.880


Instruction: Please provide detailed information about CVE-2025-22722

CVE:CVE-2025-22722
Description:Missing Authorization vulnerability in Widget Options Team Widget Options allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Widget Options: from n/a through 4.0.8.
published:2025-01-21T18:15:16.057


Instruction: Please provide detailed information about CVE-2025-23454

CVE:CVE-2025-23454
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook allows Reflected XSS. This issue affects Nature FlipBook: from n/a through 1.7.
published:2025-01-21T18:15:16.223


Instruction: Please provide detailed information about CVE-2025-23461

CVE:CVE-2025-23461
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Dotta, Jacopo Campani, di xkoll.com Social2Blog allows Reflected XSS. This issue affects Social2Blog: from n/a through 0.2.990.
published:2025-01-21T18:15:16.387


Instruction: Please provide detailed information about CVE-2025-23477

CVE:CVE-2025-23477
Description:Missing Authorization vulnerability in Realty Workstation Realty Workstation allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Realty Workstation: from n/a through 1.0.45.
published:2025-01-21T18:15:16.570


Instruction: Please provide detailed information about CVE-2025-23489

CVE:CVE-2025-23489
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner of WebDevStudios WP-Announcements allows Reflected XSS. This issue affects WP-Announcements: from n/a through 1.8.
published:2025-01-21T18:15:16.740


Instruction: Please provide detailed information about CVE-2025-23551

CVE:CVE-2025-23551
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P. Razvan SexBundle allows Reflected XSS. This issue affects SexBundle: from n/a through 1.4.
published:2025-01-21T18:15:16.927


Instruction: Please provide detailed information about CVE-2025-23580

CVE:CVE-2025-23580
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Garvin BizLibrary allows Reflected XSS. This issue affects BizLibrary: from n/a through 1.1.
published:2025-01-21T18:15:17.133


Instruction: Please provide detailed information about CVE-2025-23994

CVE:CVE-2025-23994
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings allows Stored XSS. This issue affects Estatebud – Properties & Listings: from n/a through 5.5.0.
published:2025-01-21T18:15:17.313


Instruction: Please provide detailed information about CVE-2025-23996

CVE:CVE-2025-23996
Description:Cross-Site Request Forgery (CSRF) vulnerability in anyroad.com AnyRoad allows Cross Site Request Forgery. This issue affects AnyRoad: from n/a through 1.3.2.
published:2025-01-21T18:15:17.503


Instruction: Please provide detailed information about CVE-2025-24019

CVE:CVE-2025-24019
Description:YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability allows any authenticated user to arbitrarily remove content from the Wiki resulting in partial loss of data and defacement/deterioration of the website. In the context of a container installation of YesWiki without any modification, the `yeswiki` files (for example .php) are not owned by the same user (root) as the one running the FPM process (www-data). However in a standard installation, www-data may also be the owner of the PHP files, allowing a malicious user to completely cut the access to the wiki by deleting all important PHP files (like index.php or core files of YesWiki). Version 4.5.0 contains a patch for this issue.
published:2025-01-21T18:15:17.933


Instruction: Please provide detailed information about CVE-2025-24020

CVE:CVE-2025-24020
Description:WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue.
published:2025-01-21T18:15:18.157


Instruction: Please provide detailed information about CVE-2025-24456

CVE:CVE-2025-24456
Description:In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
published:2025-01-21T18:15:18.320


Instruction: Please provide detailed information about CVE-2025-24457

CVE:CVE-2025-24457
Description:In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
published:2025-01-21T18:15:18.520


Instruction: Please provide detailed information about CVE-2025-24458

CVE:CVE-2025-24458
Description:In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
published:2025-01-21T18:15:18.697


Instruction: Please provide detailed information about CVE-2025-24459

CVE:CVE-2025-24459
Description:In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
published:2025-01-21T18:15:18.890


Instruction: Please provide detailed information about CVE-2025-24460

CVE:CVE-2025-24460
Description:In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
published:2025-01-21T18:15:19.067


Instruction: Please provide detailed information about CVE-2025-24461

CVE:CVE-2025-24461
Description:In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
published:2025-01-21T18:15:19.260


Instruction: Please provide detailed information about CVE-2025-23369

CVE:CVE-2025-23369
Description:An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users.  Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
published:2025-01-21T19:15:12.147


Instruction: Please provide detailed information about CVE-2025-24024

CVE:CVE-2025-24024
Description:Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible.
published:2025-01-21T20:15:46.617


Instruction: Please provide detailed information about CVE-2025-21489

CVE:CVE-2025-21489
Description:Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping).  Supported versions that are affected are 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data as well as  unauthorized read access to a subset of Oracle Advanced Outbound Telephony accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
published:2025-01-21T21:15:13.577


Instruction: Please provide detailed information about CVE-2025-21490

CVE:CVE-2025-21490
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:13.703


Instruction: Please provide detailed information about CVE-2025-21491

CVE:CVE-2025-21491
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:13.833


Instruction: Please provide detailed information about CVE-2025-21492

CVE:CVE-2025-21492
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.36 and prior and  8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:13.970


Instruction: Please provide detailed information about CVE-2025-21493

CVE:CVE-2025-21493
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are 8.4.3 and prior and  9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:14.103


Instruction: Please provide detailed information about CVE-2025-21494

CVE:CVE-2025-21494
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:14.240


Instruction: Please provide detailed information about CVE-2025-21495

CVE:CVE-2025-21495
Description:Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Firewall.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Firewall. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:14.367


Instruction: Please provide detailed information about CVE-2025-21497

CVE:CVE-2025-21497
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
published:2025-01-21T21:15:14.490


Instruction: Please provide detailed information about CVE-2025-21498

CVE:CVE-2025-21498
Description:Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
published:2025-01-21T21:15:14.617


Instruction: Please provide detailed information about CVE-2025-21499

CVE:CVE-2025-21499
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:14.750


Instruction: Please provide detailed information about CVE-2025-21500

CVE:CVE-2025-21500
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:14.910


Instruction: Please provide detailed information about CVE-2025-21501

CVE:CVE-2025-21501
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:15.050


Instruction: Please provide detailed information about CVE-2025-21502

CVE:CVE-2025-21502
Description:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and  21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
published:2025-01-21T21:15:15.180


Instruction: Please provide detailed information about CVE-2025-21503

CVE:CVE-2025-21503
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:15.313


Instruction: Please provide detailed information about CVE-2025-21504

CVE:CVE-2025-21504
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:15.447


Instruction: Please provide detailed information about CVE-2025-21505

CVE:CVE-2025-21505
Description:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
published:2025-01-21T21:15:15.573