• Skip to Content
  • Skip to Sidebar
  • Skip to Footer

Resume Genius

The World's Smartest Resume Builder

Monday to Friday, 8AM – 12AM (Midnight) and Saturdays and Sundays, 10AM – 6PM EDT (866) 215-9048

Cover Letter Templates

Need a cover letter template? Download any of our 200+ free cover letter templates for Word, then fill out a copy-paste cover letter template to pair with your resume and complete your job application.

Use a Genius Cover Letter Template

Advanced Cover Letter Skin Blue

Use the "Advanced" cover letter template to apply for competitive jobs and advance your career.

Clean Cover Letter Skin Orange

The "Clean" cover letter template lives up to its name, with simple formatting and an easy-to-read font.

Corporate Cover Letter Skin Navy Blue

With its simple, bold design, the “Corporate” cover letter template is ideal for confident business professionals.

Modern Cover Letter Skin Red

Minimal and sleek, the "Modern" template is ideal for marketing and business professionals.

Minimalist Cover Letter Skin Green

Our "Minimalist" cover letter template embraces simplicity while maintaining a unique visual style.

Majestic Cover Letter Skin Orange

The “Majestic” uses a unique cityscape header to draw attention to your cover letter.

Pantheon Cover Letter Skin Orange

The "Pantheon" cover letter template's bold header projects confidence, making it ideal for executives.

2024 Cover Letter Skin Red

Designed for the modern job seeker, our "2024" cover letter template is perfect for people in any industry.

Classic Cover Letter Skin Blue

"The Classic" cover letter template is clean, traditional, and the perfect format to start off your application.

Windsor Cover Letter Skin Green

The "Windsor" cover letter template uses a unique header to design to grab the attention of employers.

Chicago Cover Letter Skin Navy Blue

Featuring bold, dark lines the “Chicago” cover letter template projects confidence.

Taj Mahal Cover Letter Skin Blue

Featuring a bold gray header block for your name and contact information, the "Taj Mahal" template projects confidence.

Elegant Cover Letter Skin Grey

The "Elegant" cover letter template gives your header a sophisticated look, making it ideal for a variety of jobs.

Professional Cover Letter Skin Blue

Timeless and formal, our "Professional" cover letter template is an update of a design used by job seekers for decades.

Milano Cover Letter Skin Green

Elegant and classic, the "Milano" template gives your cover letter a timeless, sophisticated look.

Free Cover Letter Template Downloads

Professional templates.

A professional cover letter template suits experienced candidates applying to large companies. If you’re an executive or seeking a senior position, use one of these templates to write a confident and authoritative cover letter.

Minimalist Cover Letter Template, Blue — hubpage image for our cover letter templates landing page

Why it’s called the “Minimalist”

As the name suggests, the Minimalist cover letter features a simple design aesthetic that doesn’t distract from its content. At the same time, a bit of color is added to allow you to express your individuality—do you suit an ambitious red or an industrious blue?

Who should use it?

The Minimalist’s uncomplicated layout and design make it suitable for a myriad of roles. Its simplicity also makes it easy to format to your needs.

Use this design if you value clarity and effectiveness. If you don’t have Microsoft Word, you can find similar cover letter templates for google docs

Format and styling details

Major Features

  • Colored name header and contact icons

Text Details

  • Name/Header Font: Raleway
  • Content Font: Calibri
  • Name Font Size: 35pt
  • Body Font Size: 11.5pt

How to access this template

Cover letter builder.

Use our software and create a cover letter with a premade template. Let the Genius cover letter generator help you make your cover letter in minutes.

Everest Cover Letter Template, Orange — image for cover letter templates hubpage

Featuring strong colors and a bold header, our "Everest" cover letter template is guaranteed to help you stand out.

Why it’s called the “Everest”

The Everest’s dominating dark-and-light color scheme will allow you to tower over your competition. It exudes an earthiness that reflects your dependability, a soft skill that hiring managers consistently prioritize.

The Minimalist’s simple layout and design make it suitable for a wide range of positions. Moreover, its lack of visual complexity makes it easy to format.

Use the Everest if you are a rock-solid candidate.

  • Colored name header, contact icons, and horizontal lines
  • Name/Header Font: Montserrat
  • Content Font: Proza Libre Light
  • Name Font Size: 28pt

Premium Cover Letter Template, pink — image for cover letter templates hubpage

Clean and sleek, the "Premium" cover letter template is a great choice for job seekers in creative industries.

Why it’s called the “Premium”

The Premium is our most sophisticated cover letter template yet. It hints at a high level of luxury, albeit one that the average person can aspire to.

Use the Premium template if you don’t count yourself among the hoi polloi of job seekers: the Premium template suggests that you are a top-tier candidate.

  • Colored contact header, and the applicant’s name encased in an elegant box.
  • Name/Header Font: Proza Libre Medium
  • Name Font Size: 32pt

Cosmopolitan Cover Letter Template, Violet — image for cover letter templates hubpage

Simple yet stylish, our "Cosmopolitan" cover letter template will help you get noticed for the right reasons.

Cosmopolitan

Why it’s called the “Cosmopolitan”

The Cosmopolitan uses a diverse range of bright, eye-catching colors that echo the variety found in the modern world.

This template is perfect for those who are proud of their background, crave a career that matches their personality, and aspire to contribute to their new role in their own way.

Modern Templates

Pair a modern cover letter template with your resume to show some personality in your job application. This style of cover letter template is ideal for job seekers applying to work in tech, at startups, or in industries like marketing and design.

The 2024 modern cover letter template in black

Why it’s called the “2024”

The “2024” is our latest and most advanced of all our cover letter templates . “2024” embraces the future while staying true to design principles that have survived for decades, making it ideal for job seekers navigating today’s volatile job market.

The 2024 template is versatile and modern. Anybody can use this template — whatever role they’re applying for.

  • Clear, bold heading that clearly displays your name
  • Name/Header Font: Lora
  • Content Font:  Open Sans
  • Name Font Size: 24pt
  • Contact Details Font Size: 11pt
  • Body Font Size: 11pt

The Advanced modern cover letter template in blue

Why it’s called the “Advanced”

The Advanced template is designed for those who can boast advanced technical skills or an in-demand specialty.

Paired with the Advanced resume template that helps job seekers show off their skills, this cover letter template is perfect for those who want to advertise their expertise or technical knowledge.

  • A colored band containing your contact details paired with a matching band at the bottom of the cover letter.
  • Name/Header Font: Poppins

Corporate Cover Letter Skin Red

Formal and bold, the “Corporate” template’s strong header makes it ideal for applying to managerial positions.

Why it’s called the “Corporate”

Professionalism and industriousness are the watchwords of the Corporate template, which is sure to suit those seeking career advancement.

Ambitious go-getters who aren’t afraid of working hard to deliver for themselves and their firm.

  • Colorful header with clearly displayed name and contact details. White font color for your name is indicative of modesty and quiet confidence.
  • Name/Header Font: Nunito Sans
  • Content Font:  Nunito Sans
  • Name Font Size: 26pt

Hybrid Modern Cover Letter Template, Orange Color, image for cover letter templates hubpage

Our "Hybrid" cover letter template combines formal formatting with colorful accents.

Why it’s called the “Hybrid”

The “Hybrid” cover letter template may have a splash of color, but it’s nevertheless professional. The balance of aesthetics and formality hints to hiring managers that you are a diligent, competent candidate.

Candidates with solid interpersonal skills who are ready to hit the ground running in their new workplace.

  • Colorful accents at the top and bottom of the cover letter with a gray background behind your name.
  • Name/Header Font: Roboto
  • Content Font:  Roboto

Creative Templates

Our creative cover letters perfectly balance professionalism and personality. Use one of these unique cover letter templates if you’re applying for work in a contemporary field like design or marketing.

Notre Dame Creative Cover Letter Template, green version for cover letter templates hubpage

The "Notre Dame" template uses bold rectangles in its header, placing emphasis on your name and contact details.

Why it’s called the “Notre Dame”

Inspired by the impressive buttresses of Paris’ most famous cathedral, the Notre Dame cover letter template’s bold lines and subtle colors are designed to draw the attention of any hiring manager.

The Notre Dame cover letter template is perfect for candidates who aren’t afraid to give their job application some flair. It’s ideal for job seekers who are applying for work in less formal industries like marketing or design.

  • Colorful header and large name
  • Name/Header Font: Yanone Kaffeesatz
  • Content Font:  Noto Sans Display

The Cool creative cover letter template in blue

Featuring a bold sidebar and modern font, the "Cool" cover letter template gives your application a sleek, confident look.

Why it’s called the “Cool”

Stylish and modern, the “Cool” cover letter template is designed to give your application a confident but subdued look. The bold sidebar and bottom-aligned contact information help grab attention and direct it toward your cover letter’s content.

The “Cool” cover letter template’s sleek but professional appearance makes it ideal for job seekers looking for creative work in a more buttoned-up industry, such as advertising or UI/UX design.

  • Bold sidebar header and a sans-serif font
  • Content Font:  Montserrat

Westminster Creative Cover Letter Template, black version for cover letter templates hubpage

The "Westminster" cover letter template is creative but minimalist, making it perfect for a variety of jobs.

Westminster

Why it’s called the “Westminster”

Featuring a clean header and refined signature font, the Westminster cover letter template was inspired by the elegant architecture of London’s center of government. This template is the perfect mix of formality and playfulness, making it ideal for just about any contemporary job.

Formal yet lively, the Westminster cover letter template is perfect for candidates in advertising or online marketing.

  • Large header emphasizes your name
  • Playful script font for the signature
  • Name/Header Font: Oswald
  • Content Font:  Poppins
  • Name Font Size: 34pt

The Visual cover letter template in orange

Eye-catching and clean, the "Visual" template is designed to make your cover letter stand out.

Why it’s called the “Visual”

Clean, organized, and modern, the “Visual” cover letter template is designed to help your application stand out while staying professional. When paired with the busyness of the “Visual” resume template, this cover letter provides the perfect balance to your job application.

The “Visual” template is perfect for anyone in a creative industry looking to give their cover letter a buttoned-up, contemporary look.

  • Clean header and neatly organized contact information

Simple Templates

Write a clear and organized cover letter using a simple cover letter template. Each basic template is free to download (compatible with Microsoft Word and Google Docs), and will help you create the perfect cover letter for whatever job you apply for.

The Classic 2.0 cover letter template in dark blue, used for the /cover-letter-templates hub page

The Classic

Why it’s called the “Classic”

The Classic template draws on longstanding design principles to provide a cover letter that can be used for a variety of professions and experience levels. Our Classic 2.0 design adheres to those principles, while offering a fresh take on the standard cover letter format .

The Classic template is a great choice for job seekers who want the reader to focus on their content rather than layout.

  • Name and contact details are separated from the core content by a line
  • Compatible cover letter template for google docs
  • Font Style: Lora
  • Name Font Size: 22pt
  • Contact Details Font Size: 22pt

The Chicago cover letter template

Inspired by the architecture of its namesake city, the "Chicago" cover letter template is bold and professional.

Why it’s called the “Chicago”

“The Windy City is mighty pretty,” and so is the Chicago template. Just like Illinois’ largest city, the Chicago template is a real people pleaser, with something that appeals to everyone.

This modern, versatile template is a pragmatic choice for those seeking to prove they can thrive in the workplace with their cover letter.

  • Centered name and contact details
  • Font Style: STIX Two Text

The Connery cover letter template in brick red

The "Connery" cover letter template exudes confidence with its bold name bar, ensuring that employers remember you.

Why it’s called the “Connery”

The Connery cover letter template is bold but buttoned-up. The name bar immediately catches the eyes of employers and puts emphasis on your name, ensuring they remember your application after they’re done reviewing it.

The Connery is a great choice for anyone who wants to make a strong first impression.

  • A colorful name bar followed by your contact details.
  • Font Style: Roboto Slab
  • Name Font Size: 19pt

White House Cover Letter Template, Dark Blue (for Cover Letter Templates hub page)

Graceful and powerful, our "White House" is perfect for job seekers applying for government-related work.

White House

Why it’s called the “White House”

Our new “White House” cover letter template exudes confidence and prestige. The heading stands out without being flashy, and gives your cover letter the distinguished appearance worthy of a powerful political figure.

Anyone applying for a job at the local, state, or federal level of government, as well as anyone looking to convey that they’re a serious applicant truly interested in a role.

  • The White House template features a bold header that splits your name (aligned to the left) from your relevant contact details (aligned to the right). Symmetry fit for a consummate professional.
  • Font Style: Arimo
  • Name Font Size: 18pt

Picture Templates

These picture cover letter templates are ideal if you’re applying for jobs in a country where you’re expected to include a photo with your job application. Each template is designed to look sleek and quickly grab the attention of employers.

The Original Picture picture cover letter template in blue

Our “Original Picture” template provides plenty of space in the header for your headshot, helping you grab attention.

Original Picture

Why it’s called the “Original Picture”

The header of the “Original Picture” is what makes it so compelling. Distinct, unique, and with space for a photo, it has everything you need to leave a lasting impression.

If originality and creativity are traits you want to emphasize with your cover letter, the “Original Picture” ticks all the boxes.

  • Tasteful design details that elevate your cover letter
  • Heading Font: Oxygen
  • Content Font: Oxygen

The Photo photo cover letter template in yellow

With a subtle full-color background, our “Photo” template will give your cover letter a chic, artsy look.

Why it’s called the “Photo”

TWho says that color should be reserved for the header of your cover letter? Frame yourself and your experience in a way that catches employers’ attention with the “Photo”.

Want to literally and figuratively highlight all the reasons why you’re the most qualified person for the job? The “Photo” does the trick.

  • A colorful background on which to display your greatest accomplishments
  • Heading Font: Cormorant SC
  • Content Font: Source Sans Pro

The Fresh picture cover letter template in wine featuring a subtle gradient in the background

Featuring clean lines and a gradient background, our “Fresh” cover letter template will help your application stand out.

Why it’s called the “Fresh”

Clean lines, a straightforward layout and appealing colors make this template a breath of fresh air.

The “Fresh” matches the needs of professionals who want to take their cover letter to the next level visually. This template achieves just that, without distracting from your accomplishments.

  • A minimalistic header that emphasizes your name and title
  • Heading Font: Inter
  • Content Font: Inter

The Headshot photo cover letter template in purple-pink

Our “Headshot” cover letter template applies color to give your cover letter a sleek, modern look.

Why it’s called the “Headshot”

This template makes clever use of color to add a bit of dimension to your cover letter without going overboard on the design details. The two-tone color scheme keeps things exciting and makes your headshot pop.

The “Headshot” is a great choice for actors, models, and professionals in the entertainment industry. However, its minimalistic yet attractive design makes it suitable for job seekers in any field.

  • Heading Font: Lato
  • Content Font: Lato

Google Docs Templates

Need a cover letter to pair with your Google Docs resume template ? These sleek, contemporary cover letter templates will help elevate your job application without ever needing to download expensive word processing software.

The "Coral" Google Docs cover letter template

Opening with a casual greeting, the “Coral” Google Docs cover letter template gives off friendly, youthful energy.

What’s unique about this template?

Though it has a simple format, the Coral cover letter template features a hint of color and a unique header font that create an air of sophistication.

The Coral template is a good choice for candidates who want to add a touch of personality and class to their cover letter.

  • Coral-colored introductory text and stylish fonts that draw the eye
  • Right-aligned contact information in the header
  • Heading Font: Playfair Display
  • Body Font Size: 10pt

The "Swiss" Google Docs cover letter template

Using a simple, technical design with a little color, the “Swiss” cover letter template is perfect for jobs in tech or marketing.

The Swiss cover letter template uses two columns, with one featuring a candidate’s name and contact information, and the other containing the body of the cover letter. This layout effectively uses white space for extra visual flair.

The Swiss cover letter template is perfect for those who can write a concise cover letter and want their application to stand out.

  • Attention-grabbing job title, contact information, and signature in orange text
  • Content aligned in a single column using a standard resume format
  • Heading Font: Raleway

An example of the "Geometric" Google Docs cover letter template

With its blocky background graphics, the “Geometric” cover letter template is best suited to apply for jobs in programming.

The Geometric template uses a bold design and color palette that is sure to get the attention of employers.

If you’re looking for work in a modern and creative industry like design or tech, the Geometric template could be the one for you.

  • Colorful fonts that highlight the candidate and hiring manager’s names
  • Geometric shapes and icons that add visual interest
  • Heading Font: Roboto
  • Content Font: Roboto
  • Name Font Size: 20pt

An example of the "Online" Google Docs cover letter template

Formal yet colorful, choose the “Online” template if you want to keep things professional but still stand out.

The teal heading underscored by a gray contact information bar makes sure employers know who you are and how to contact you.

This template is a good option for candidates looking to add a light touch of color and personality to their application.

  • A bold header that makes your name memorable
  • Teal color accents that highlight the candidate’s job title and signature
  • Heading Font: Lora
  • Content Font: Arimo
  • Name Font Size: 40pt

Microsoft Word Templates

These cover letter templates for Microsoft Word come in a number of eye-catching colors and professional designs. Be sure to pair your favorite cover letter template with the matching Microsoft Word resume template .

The Swiss cover letter template from Microsoft Word featuring a full color yellow background

The Swiss cover letter template features a striking color scheme and a unique layout to draw attention.

For candidates looking to turn heads with their application, the Swiss cover letter template will deliver.

  • Bold yellow background with distinct black lines
  • A large header that contains the candidate’s name and contact information
  • Heading Font: Univers
  • Content Font: Univers
  • Name Font Size: 36pt
  • Body Font Size: 9pt

The Polished cover letter template from Microsoft Word featuring a bright red header bar

With bold color features and a distinct font pairing, the Polished cover letter template demonstrates personality and confidence.

The Polished template is well-suited to candidates in creative industries who are looking to make an impression.

  • Bright coral-colored header featuring a ring to display a candidate’s initials
  • Distinctive fonts that will make your cover letter stand out
  • Heading Font: Franklin Gothic Dem
  • Content Font: Rockwell
  • Name Font Size: 25pt

The Playful cover letter template from Microsoft Word featuring a side bar with colorful shapes

The Playful template lives up to its name with a fun color palette and whimsical design. The high contrast between the sidebar and the cover letter body text adds visual interest and flow.

The Playful template is well-suited to candidates applying for jobs in creative fields like marketing or design.

  • A sidebar with colorful bubbles that displays a candidate’s photo, name, and contact information
  • Icons that draw attention to the candidate’s contact details
  • Heading Font: Calibri
  • Content Font: Calibri

The Crisp and Clean cover letter template from Microsoft Word featuring yellow geometric sections

Crisp and Clean

The Crisp and Clean template offers a unique and unexpected layout along with light color accents. With each part of the cover letter neatly organized and defined, this template is pleasing to the eye and easy to read.

This template is perfect for candidates who appreciate a simple design aesthetic and clear structure.

  • Yellow outlines and shapes delineate the space
  • Effective use of white space makes the page look tidy and spacious
  • Heading Font: Century Gothic
  • Content Font: Century Gothic
  • Name Font Size: 23pt

CV Templates

Looking for a cover letter to pair with your CV? Whether you’re applying to an academic position or a research job, our CV cover letter templates are designed to give your application a refined, professional appearance.

The "Writer" CV cover letter in red

If you write in any professional capacity, our "Writer" template will help you highlight your writing proficiency.

Why it’s called the “Writer”

Thanks to its subtle design and space-efficient layout, our “Writer” cover letter template gives you plenty of space to highlight your writing proficiency and style.

The “Writer” cover letter template is perfect if you’re applying to work as a teacher or any other job that requires strong writing abilities.

Use our software and create a cv with a premade template. Let the Genius cv generator help you make your cv in minutes.

The "Research" CV cover letter in dark blue

Our "Research" cover letter template uses a formal design to help emphasize your accomplishments in your field of research.

Why it’s called the “Research”

The “Research” cover letter template is designed to help you land those competitive research positions. Its blocky design and elegant header help you make a strong first impression without detracting from your qualifications.

You should use the “Research” cover letter template if you’re applying to jobs where your technical skillset matters, like those in academic research or computer science .

The "Harvard" CV cover letter in black grey

With a name that evokes prestige, our "Harvard" cover letter template is the perfect accessory to your CV.

Why it’s called the “Harvard”

With a name that evokes prestige, our “Harvard” CV cover letter template is the perfect design to pair with your impressive and thorough curriculum vitae.

With its clean, formal design, you should use the “Harvard” cover letter template if you want to project confidence. It’s best used if you’re applying for higher-level jobs, such as an operations manager or marketing manager .

The "Graduate" CV cover letter in forest green

Our "Graduate" cover letter template is formal and elegant, making it well suited to help you apply for any position.

Why it’s called the “Graduate”

The “Graduate” cover letter template uses a bold header font and clean lines to help your CV look both friendly and contemporary, helping you stand out even if you’re fresh out of grad school.

The “Graduate” cover letter template’s formal design and subtle details makes it the ideal choice for scholars writing an academic job application.

How to Use a Cover Letter Template

Free Fill-in-the-Blank Cover Letter Templates

How to Use a Free Cover Letter Template

To use one of our professionally-designed cover letter templates, simply:

  • Select the template you like and click on “View Template.”
  • Download it as a Word Doc or Google Doc , and select the option of your choice under “How to download this template” (If you want to use a Google Doc, make sure to select the color option you want before making a copy).
  • Edit the document , using the template text as a guide to fill in your own experience.
  • Save your cover letter as a Word document or PDF to send to employers, using a professional file name like “your-name-cover-letter.pdf”.

To write a good cover letter and impress employers, follow the best cover letter formatting practices and make sure to demonstrate why you’re a good fit for the specific company .

Using a template helps you create a professional application and makes it much easier to quickly modify your cover letter for different jobs.

Copy & Paste Cover Letter Template

You can copy and paste this template into a doc to use as an easy-to-follow outline:

Your Name Street Address City and Zip Code Your Phone Number

Today’s Date

Addressee’s/Hiring Manager’s Name Job Title Organization/Company Name Street Address City and Zip Code

Opening paragraph: State who you are, say where you found the job listing, and explain why you’re interested in the position.

Body paragraphs: Give an overview of your previous job experience, skills, qualifications, and accomplishments. Don’t repeat your resume. Explain what makes you a unique candidate and how you can help the company meet its goals. Use numbers to back up your claims.

Closing paragraph: State that you’d like to schedule an interview and provide your contact information. Say you’ll be in touch within a week if you don’t hear back. Finish by thanking the employer for their time and consideration.

Warm regards,

As many as 94% of hiring managers think cover letters are influential when it comes to deciding who to interview, so use your cover letter as an opportunity to connect with employers and highlight why you’d make a smart hire .

4 Downloadable Cover Letter Templates

Choose a free fill-in-the-blank cover letter template below and fill in your information to create a personalized cover letter.

1. Professional Cover Letter

Looking for a classic cover letter that’ll work for any job application? Our original professional cover letter template ensures you’ll have a polished cover letter without worrying about finicky formatting or design.

Download this free sample and fill in the blanks with your skills and experience to show employers how your qualifications align with the role.

Professional cover letter template in a navy blue design.

2. Creative Cover Letter

Our fashionable cover letter template has a light and professional tone and focuses on your enthusiasm and achievements. If you’re applying at a forward-looking company, a modern cover letter like this shows you’re a good cultural fit.

This free template is easy to personalize in Word, and has lots of room for you to showcase your originality and voice.

Creative cover letter template in yellow.

3. Entry Level (No Work Experience) Cover Letter

When you’re writing your first cover letter, you can focus on the skills you gained through your education, volunteer work, extracurriculars, and hobbies.

Our Unique cover letter template helps you explain why you’re a top candidate, even if you have no work experience. Simply download the Word doc and customize it.

job application letter sample pdf free download

4. Experienced Professional Cover Letter

Need an application letter for a senior position? Our Milano cover letter template offers a clear format for presenting your skill set and accomplishments.

If you’re established in your field or applying for a promotion, this sophisticated template will help you make a powerful impression.

job application letter sample pdf free download

Make a cover letter in minutes

Pick your template, fill in a few details, and our builder will do the rest.

COVER LETTER SAMPLES

See our cover letters in action

Read through our professional cover letter examples for inspiration when writing your own. Each sample has been approved by a professional career expert from our team, and uses a free cover letter template that you can download and customize.

Career & Life Situations

Not sure how to write a cover letter for your background? Whether you have gaps in your career, or are just graduating college, our career and life-situation cover letter templates include downloadable examples and tips to help you make a cover letter that’s ideal for your situation.

a career change cover letter example

Examples By Job Type

Below you’ll find some of our most popular industry-specific cover letter examples, which you can download immediately for free and use as a guide when creating your own cover letter.

Example of a teacher cover letter for a school application.

Frequently asked questions

Here are some essential cover letter tips and suggestions that will help you land more interviews and a job.

What should a cover letter include?

A cover letter should include five essential parts:

  • Contact information
  • A personalized greeting
  • An eye-catching cover letter introduction
  • Convincing body content about your expertise
  • A powerful cover letter closing and sign off

What should not be included in a cover letter?

You shouldn’t include any false information in a cover letter, or the same information that’s already on your resume. It’s also important to avoid these mistakes:

  • Spelling and grammar errors
  • Addressing your cover letter to the wrong person
  • Including your salary expectations
  • Adding personal details unrelated to the job

Do I need a unique cover letter for every job?

While it’s not necessary to create a unique cover letter for every job, it does improve your chances of making a good first impression and landing an interview.

Each company has different challenges they’re trying to tackle through hiring. By writing a new cover letter draft for every job, you can explain why you’re uniquely qualified to contribute.

How long should my cover letter be?

Your cover letter should be between half a page and one full page in length, or about 200 to 500 words. This is the standard cover letter length because it’s concise, and keeps the hiring manager’s attention.

Do I really need a cover letter?

You need a cover letter if:

  • The job you’re applying to requires one
  • You’ve been recommended for the job
  • You want to provide information that isn’t included in your resume

Should my resume and cover letter template match?

Your job application will look much more consistent and professional if you use a matching resume and cover letter template.

Using mismatched templates can come across as unprofessional and might make it look like you didn’t put much thought or effort into your job application.

More questions? Visit our FAQ library.

Related Articles

job application letter sample pdf free download

Cover Letter Help

Headshot of Conrad Benz

Conrad Benz

job application letter sample pdf free download

Corissa Peterson

job application letter sample pdf free download

Rebecca Tay, Ph.D.

Thanks for downloading our free template!

Would you leave us a review?

  • Resume Templates Simple Professional Modern Creative View all
  • Resume Examples Nurse Student Internship Teacher Accountant View all
  • Resume Builder
  • Cover Letter Templates Simple Professional Modern Creative View all
  • Cover Letter Examples Nursing Administrative Assistant Internship Graduate Teacher View all
  • Cover Letter Builder

Modern cover letter templates

Take a fresh approach with our stylish, modern cover letter templates perfectly designed to give you the edge in innovative industries.

Modern cover letter template Stockholm

Reviewed by the community. Trusted by professionals

A modern cover letter template to make a strong impression.

From tech and IT to marketing and start-ups, there are dozens of jobs and industries where a standard cover letter just won’t cut it. That’s why we’ve created this collection of modern cover letter templates that exude confidence and style. 

To make the most out of your modern cover letter template, make sure to keep your writing concise and energetic. Strong action verbs and specific examples will work together with a bold template to ensure your cover letter stands out no matter how large the application pool. Check out this general guide for even more tips on writing a great cover letter.

In today’s job market, hiring managers are looking for candidates with fresh ideas who aren’t afraid to be themselves. By picking a modern cover letter template, you can rest assured that your visuals are just as bold as your personality and experience.

When to pick a modern job application letter template

There are a few key indicators that a modern job application letter template is the right choice. Does your potential employer value unique perspectives and originality? Are their offices filled with bold colors, sleek furniture and a general youthful vibe? These are good signs that a modern template will work well for this particular position or workplace. Even if you don’t have any inside knowledge of the company you’re applying to, you can use their website to get a feel for their branding and image to decide if a modern application letter template is right for you.

To get the most out of your modern job application letter template, make sure to match it with a modern resume template. You can browse our collection here .

A modern job application letter template can also work well for freelancers and entrepreneurs. These templates are all about achieving the balance between professionalism and personal style, which makes them some of the most versatile in our collection.

Top 5 why choose a modern cover letter for a resume

  • Your industry or position requires a nontraditional approach
  • You want your application to stand out in a big way
  • You’re looking for a balance of professionalism and bold design
  • You want to freshen up a previous cover letter
  • You want to present yourself as a forward-thinking candidate

What makes a modern application letter

Although a modern template is a great starting point, you’ll need to embody the values of a modern application letter in both your visuals and your writing if you want to land a job in an innovative industry. Often, these positions are great for recent grads or early career professionals, but they can also lend themselves to candidates with years of expertise. The trick is to highlight how and why you’ve stayed at the forefront of your field, paying attention to new developments and trends.

Modern professionals know the best practices of traditional workplaces, but they’re not scared to change with the times. When writing a modern application letter, don’t be afraid to highlight moments when you thought outside the box or times when you created new initiatives and took a risk that led to positive results.

Free modern cover letter template – download as PDF or Word file

With Resume.io, you can pick a cover letter that’s stylish, professional and just right for your needs – but the best part? It’s free. Choose whether you’d like to download it as a PDF, Word file or even in Google Docs to make the most of your template in whichever platform you prefer.

The job search can be stressful. Our free modern cover letter template is designed to simplify the process and allow you to focus on showing off your best attributes without worrying about the visuals. With our free modern cover letter template you can rest assured you’re getting the perfect balance of attractive and functional design.

Try our professional Resume builder now!

Examples

Job Application Letter

Job application letter maker.

job application letter sample pdf free download

A Job Application Letter is a critical tool for making a positive first impression on potential employers. It’s your chance to showcase your skills and enthusiasm for the position. This guide, complete with letter examples , will walk you through the process of creating a compelling application letter. You’ll learn how to highlight your experiences effectively, tailor your letter to specific jobs, and stand out from other applicants. With these tips and examples, crafting a job application letter that grabs attention becomes an achievable goal.

Job Application Letter Bundle

Download Job Application Letter Bundle

Before you can be considered for a recruitment interview, there are several materials that you need to hand to the employer. One of these is the job application letter. This document accompanies your resume in terms of giving information about your qualifications and other deliverable. We have come up with a list of downloadable job application letters that you can use as guides and references. Browse through them so you can come up with a well-structured, impressive and efficient job application letter.

Job Application Letter

Size: 13 KB

Free Download

Job Application Letter for Company

Job Application Letter for Company

Job Application Letter for Teacher

Job Application Letter for Teacher

Size: 19 KB

Formal Job Application Letter Template

Formal Job Application Letter Template

  • Google Docs

Size: 59 KB

Job Application Letter for Undergraduate Student Template

Job Application Letter for Undergraduate Student Template

  • Apple Pages

Size: 38 KB

Marketing Assistance Job Application Letter Template

Marketing Assistance Job Application Letter Template

Size: 51 KB

Job Application Letter For Junior Accountant Template

Job Application Letter For Junior Accountant Template

Size: 48 KB

Job Application Letter for Employment Template

Job Application Letter for Employment Template

Size: 62 KB

Fresher Job Application Letter Template

Fresher Job Application Letter Template

Size: 40 KB

Email Job Application Letter Template

Email Job Application Letter Template

Job Application Letter for Junior Doctor Template

Job Application Letter for Junior Doctor Template

Free Job Application Letter For Accountant Assistant Template

Free Job Application Letter For Accountant Assistant Template

Size: 57 KB

Job Application Letter Template For Software Engineer

Job Application Letter Template For Software Engineer

Job Application Letter Template For Assistant

Job Application Letter Template For Assistant

Size: 43 KB

Job Application Letter Template For Accountant

Job Application Letter Template For Accountant

Size: 50 KB

Job Application Letter For Receptionist Template

Job Application Letter For Receptionist Template

Size: 75 KB

Job Application Letter For Receptionist Position Template

Job Application Letter For Receptionist Position Template

Size: 66 KB

Job Application Letter for Executive Assistant Template

Job Application Letter for Executive Assistant Template

Job Application Letter for Executive Template

Job Application Letter for Executive Template

Size: 58 KB

Job Application Letter for Executive Secretary Template

Job Application Letter for Executive Secretary Template

Job Application Letter For Graphic Designer Template

Job Application Letter For Graphic Designer Template

Job Application Letter for Assistant Professor Template

Job Application Letter for Assistant Professor Template

Size: 42 KB

Doctor Job Application Letter Template

Doctor Job Application Letter Template

Size: 18 KB

Clerk Job Application Letter Template

Clerk Job Application Letter Template

Size: 17 KB

Free Job Application Letter for Assistant Engineer Template

Free Job Application Letter for Assistant Engineer Template

Size: 20 KB

Free Job Application Letter for Assistant Manager Template

Free Job Application Letter for Assistant Manager Template

Size: 22 KB

Free Job Application Letter For Engineer Template

Free Job Application Letter For Engineer Template

Free Job Application Letter to Marketing Manager Template

Free Job Application Letter to Marketing Manager Template

Job Application Letter – Sample and Tips Example

Job Application Letter - Sample and Tips Example

Size: 244 KB

Good Application Letter Example

Good Application Letter Example

Application Letter / Cover Letter Example

Application Letter / Cover Letter Example

Do You Really Need a Job Application Letter?

It is already common knowledge that a resume is one of the most essential items that you need to prepare whenever you plan to apply for a job. However, it is not the only document that can affect the decisions of employers. Aside from a reference letter  written by another person, you can also create another letter that can help you in your application.

A job application letter, or a cover letter , can also greatly impact the way employers look at you as a candidate. If you can create a comprehensive and strategically-formulated cover letter, then you can have higher chances of getting a call for an interview or for the next phases of the recruitment. Here are some of the reasons why we think that making a job application letter should also be prioritized whenever you plan to immerse in the processes of searching and applying for vacant job positions open for employment:

  • A job application letter can help you easily target the demands of the work position. If there are already specifications with the minimum requirements of the job designation, your job application can provide information and instances that are aligned with what the company is looking for. Even if a resume can also do this, a job application letter is actually more thorough as it allows you to be more detailed when discussing your deliverable. You may also see email cover letter examples .
  • A job application letter can make you more desirable as a candidate. This document does not only present your skills and potential. You can also specify the items that you know about the business and its operations. Through this, you can already discuss how you can help the business achieve its goals. If the business can create the perception that you are truly knowledgeable of the specifics of the work position and why you deserve to be hired, then more interest can be given to your application. You may also like business proposal letter examples .
  • A job application letter can market your professional qualifications. The further you explain what employers can expect from you, the more they can have an overview of how you can add value to the business. This is the reason why you have to be strategic when placing information in the job application letter. As much as possible, include information that are highly-related to the work post that you are targeting and those that are directly aligned with the corporate vision, mission and objective of the company.

Cover Letter / Job Application Letter – Guidelines and Example

Cover Letter / Job Application Letter - Guidelines and Example

Size: 28 KB

Job Application Letter / Cover Letter Template Example

Job Application Letter / Cover Letter Template Example

Simple Job Application Letter Example

Simple Job Application Letter Example

Basic Job Application Letter Example

Basic Job Application Letter Example

How to Prepare Yourself Before Writing a Job Application Letter

If you want to receive a job appointment letter at the end of the recruitment process, you have to ensure that all the documents that you will submit during your application are on point. The process of developing the content, discussion flow and format of your job application letter is very important.

Unlike how others think of it, a job application letter is actually not that easy to do. Yes, you can just write a letter about your desire to apply for a particular work position any time of the day. However, the question that you need to answer is whether the document that you have written can make you standout from your competitors or not. This is why you have to take your time when planning how to come up with an impressive job application letter. Here is how you can prepare yourself whenever you are already prepared to create your own job application letter:

  • Understand the task that you have at hand. It is best for you to research about the development of an outstanding job application letter first before making it. The knowledge and thought that you have about this process can make it easier for you to understand what you need to write in the job application letter.
  • Make sure that you will have enough relevant information about your prospective employer and the job position that you would like to be hired for. Being knowledgeable of the brand, operational needs and corporate image of the business can help you associate your skills and other qualifications in a more strategic and targeted manner.
  • Think of how your job application letter can impact your chances of being noticed by employers. We never know how businesses select their new hires. Do they look at the resumes first before browsing through the job application letter, or the other way around Do they base their impressions just on your professional profile or they also keenly observe the other supplementary documents that you present? Knowing that you have developed a professional, complete and presentable job application letter can make you more confident in the processes of application which can further boost your confidence in the next phases of the recruitment.
  • Gather keywords which can be used in the job application letter. These keywords must be related to the industry where the business is a part of, the demands of the work position that you are applying for, the nature of operations of the employer, and the specifics of the daily job functions expected from the work post open for employment. Remember that your job application letter does not need to be technical and full of terms and jargon. However, you should also not forget that it must be informative.

Cover Letter for Job Application Example

Cover Letter for Job Application Example

Size: 24 KB

Job Application Letter – Example

Job Application Letter - Example

Example of a Cover / Application Letter

Example of a Cover / Application Letter

How to Impress Employers Through Your Job Application Letter

Making a job application letter is a task that you need to seriously immerse yourself into. Some people think that a job application letter is not really necessary as a resume can already present the details that the employers would like to know. However, getting higher chances of a callback does not fully rely on providing what employers need to know but also by supplying them with information that can set the standards for the other applicants. This can easily be done through the development of a job application letter that can further elaborate details that a basic resume with a generic format can’t. Listed below are some of the ways on how you can possibly impress employers once they browse through the job application letter that you have submitted. You may also see acknowledgement letter examples & samples.

  • Write the letter in an engaging manner. Ensure that the employers will feel your enthusiasm about the job position that you want to have and the possibility of being a part of the company or the business. You can do this by being aware of the tone and language that you will incorporate in the letter development.
  • Present yourself as a candidate who is not just equipped with all the qualifications needed by the job position, but someone who is willing to learn and consistently wants to excel and improve in his or her chosen craft. This allows the company to have an idea that you have an idea about the business and you have selected to apply there because you believe that the possible employment can result to all parties mutually benefit from and with one another. You may also like employee reference letter samples .
  • Discuss the key requirements of the job position but veer away from presenting those that are already in your resume. There is no need to create a job application letter if you will just repeat what is already in your professional profile. You need to give the employers more insight of who you are and what you can provide the company with if they decide to hire you. You may also check out what is an application letter?
  • Ensure that you can showcase your relevance. List a number of reasons why you are the best candidate for the work position. When stating facts about how your qualifications fit the work description, do not be boastful or overly confident. The discussion must be formal and professional so that you can also make your character shine. Employers do not just look on your professional deliverable as work ethics, character, and adaptability are also important factors that businesses look for in their possible new hires. You might be interested in thank-you letter examples.
  • Focus on the formal letter format and presentation of the job application letter as much as you give focus on the document’s content. Make sure that you will come up with an organized discussion. More so, ensure that you will print the document in a clean and business-appropriate paper. If the company asks you to send it through email, do not forget to check if the job application letter has been attached in your message accordingly. You also have the option to properly format the letter in the body of the actual email.

Cover Letter Example

Cover Letter Example

Standard Cover Letter / Application Letter Format Example

Standard Cover Letter / Application Letter Format Example

Example of a Cover Letter for Work Application

Example of a Cover Letter for Work Application

Cover Letter for Work Application Example

Cover Letter for Work Application Example

Content of a Job Application Letter

Think of your job application letter as a business proposal cover letter . The latter is used to present a blueprint or a plan that can help business transactions between corporate and/or business entities take place. The same goes with the usage of a job application letter. What do you want to present to employers? How do you want to be perceived? Do you think the content of the letter is appealing and impressive enough for an employment transaction to take place? If you can confidently answer these items, then you are on the right track.

The completion of the content in your job application letter must be highly considered. Making a comprehensive job application letter can effectively provide you with a lead advantage during the recruitment and selection process. Here are the important information that you need to include in your job application letter:

  • The date when you have written and submitted the job application letter
  • The name of the person to whom the job application letter is for and his or her connection to the company
  • The business name and other information of the company where you are applying
  • A salutation
  • The job position that you are applying for
  • The statement that you are a great fit for the work position
  • The reason why you would like to be hired for the work post by the employer
  • The relation of your professional work experiences and deliverable to your desired work position
  • The supporting details that can further strengthen your qualifications
  • The relevance of your professional expertise to the goals and objective of the business
  • A conclusion that should appeal to the employer
  • A simple statement that you will be more than willing to progress to the next phases of the hiring process
  • A statement that you will be waiting for the response of the employer regarding the matter
  • A message of appreciation for the employer’s effort and time to review your application
  • Your contact information where the employer may reach you in the future
  • A closing remark and your signature

You may also see two weeks notice letter examples & samples.

Job Application Letter for Applicants With a Gap in Career History Example

Job Application Letter for Applicants With a Gap in Career History Example

Cover Letter Layout Example

Cover Letter Layout Example

Cover Letter / Application Letter Template Example

Cover Letter / Application Letter Template Example

Benefits of Having a Comprehensive and Detailed Job Application Letter

With the stiff competition in different industries, you have to come up with ways and strategies on how you can take a step ahead of other applicants. Always remember that there are limited job opportunities that are targeted by highly-qualified and technically-equipped candidates on a daily basis. Having these in mind can help you prepare better when applying for a job. A job application letter can be one of your strengths during this process. Hence, it is important for you to create this document in the most effective way possible. A few of the benefits that you can have as an applicant if you will create a complete and precise job application letter are as follows:

  • Making a job application letter can help you introduce yourself elaborately. You can highlight your key competencies especially those that are not fully-discussed or even placed in your resume summary statement and within the entirety of your professional profile. With this, the employer can give a higher value to your accomplishments and professional experiences. Doing this can also help you showcase instances and real occurrences where your previous employers were able to benefit from your expertise and the execution of your skills in the actual work environment.
  • Creating a job application letter can make it possible for you to further express yourself. Why have you chosen the business as your first choice for possible employment? Why do you think you deserve to be hired? What kind of professional work do you want to be involved in? These are only a few of the questions that you can precisely and directly answer in a job application letter. Most resumes are constraining when it comes to the information that you need to include due to the format that you need to follow. This is not the case when making a job application letter as this document contains a conversation-like content in a professional setting. You may also see business letter examples .
  • Developing a job application letter can give you the chance to explain the weak areas of your resume. As an example, you can discuss reasons on why you have huge employment gaps or why you decided to resign from one company then to another in a short period of time. However, keep in mind that you should not sound defensive when writing these details as it can also negate the purpose of developing the job application letter which is supposed to impress employers. You may also like reference letter examples.
  • Having a job application letter as an essential part of your application strategy can help your qualifications become more tailored with the job position that you are applying for. If you have a job application letter, then you do not need to change a lot of things in your resume as you can already discuss more details in the application letter. Your professional work experiences may not be directly related to the job position that you want. Through the help of a job application letter, you may present the connection of your previous work assignments to the requirements of the new job position that you are applying for. You may also check out appointment letter examples & samples.

Short Job Application Letter Example

Cover Letter / Application Letter Template Example

Guide and Example of Job Application Letter / Cover Letter

Guide and Example of Job Application Letter / Cover Letter

Size: 14 KB

Cover Letter / Application Letter – Warning w/ Example

Cover Letter / Application Letter - Warning w/ Example

Tips to Follow When Developing a Job Application Letter

Creating an effective Job Application Letter is crucial in the job hunting process. This document, often accompanying your resume, is your opportunity to make a strong first impression. Whether you’re crafting a cover letter or a job application email, there are key elements to include for a professional cover letter. Here’s a guide to help you develop an impactful job application letter:

  • Understand the Purpose : Your job application letter is more than just a formality. It’s a personal introduction and a pitch. It should complement your resume by highlighting your relevant skills and experiences, tailored to the job you’re applying for.
  • Research the Company : Tailoring your letter to the specific company and position is crucial. Show that you have done your homework by mentioning something about the company’s values, culture, or recent achievements.
  • Start Strong : The opening of your professional cover letter sets the tone. Begin with a compelling introduction that grabs the reader’s attention. Mention the position you’re applying for and how you discovered the opening.
  • Highlight Relevant Skills and Experiences : Use the body of your letter to emphasize why you’re the right fit. Focus on experiences and skills that directly relate to the job description . Use specific examples and quantify your achievements where possible.
  • Make it Personal : Avoid generic phrases. Personalize your job application email or letter by reflecting your enthusiasm for the role and explaining why you’re passionate about working for this specific company.
  • Keep it Concise and Clear : Your letter should be easy to read and to the point. Aim for no more than one page. Use short paragraphs and bullet points for easy scanning.
  • Professional Tone and Language : While you want to show your personality, maintain a professional tone. Use formal language and avoid slang or overly casual phrases.
  • Proofread and Edit : Typos and grammatical errors can make a bad impression. Proofread your letter multiple times and consider having someone else review it as well.
  • Closing with a Call to Action : End your letter by thanking the employer for considering your application and express your interest in discussing your candidacy further in an interview.

A well-crafted Job Application Letter is your gateway to capturing the attention of potential employers. By following the outlined tips and emphasizing your unique skills and experiences, you can create a compelling and professional cover letter. Remember, this letter is your chance to make a memorable first impression, paving the way for a successful job application process.

Twitter

Text prompt

  • Instructive
  • Professional

Generate a job application letter for a college student applying for a tutor position

Write a job application letter for a recent graduate seeking a teaching assistant role in a middle school.

Cover Letter Templates you Download with One Click

We don’t want your email, have you pay, or fool you.

Microsoft Word Cover Letter Templates

Thesee free Word cover letters formats by Microsoft . They are freely editable to your liking. These formats work best in the newer versions of Word. Most of these templates are fully editable to your liking. Color, format and all the content, edit to make your own stunning cover letters! For free, with direct downloads.

word cover letter template

Classey Casey

word cover letter template

Clean Green

Edgy Edward CL e1697717512490

Edgy Edward

word cover letter format

Geometric 1

word format cover letter

Geometric 2

word cover letter template

Jack Wilson

word cover letter

Download them directly with one click. The formats might not be compatible or work optimal with older verions of MS Word.

Template cover letter docx

Little Grey

word cover letter template

Retro Ricky 1

microsoft word cover letter format

Retro Ricky 2

microsoft word cover letter format

Retro Ricky 3

Microsoft Word cover letter

Simply Good

microsoft word cover letter template

We earn by promoting  resume.io’s cover letter generator, which is completely free, always. If you later become a paying subscriber to their resume builder tool, we earn a commission, at no cost to you.

Google Doc Cover Letter Templates

Google Docs Cover Letter Template 2

Swiss Template

Google Docs Cover Letter Template 1

Spearmint Template

Google Docs CV

Modern Template

Google Docs Cover Letter Template 3

Minimal Template

Free cover letter templates.

These cover letters have been made with the, absolutely free, cover letter tool (AI-assisted) from  Resume.io .

Here you can download the Pdf- & JPEG files, but with the tool, also in Word format, so you can keep editing them yourself.

cover letter template

Cover Letter Template

cover letter template

Cover Letter Template 2

cover letter template

Cover Letter Template 3

cover letter template

Cover Letter Template 4

cover letter template

Cover Letter Template 5

cover letter template

Cover Letter Template 6

Cover Letter Template

Cover Letter Template 7

Cover Letter Template

Cover Letter Template 8

Cover Letter Sample Nurse

Cover Letter Template 9

Cover Letter Template

Cover Letter Template 10

Clara Barton Cover Letter Template 11

Cover Letter Template 11

Cover Letter Template

Cover Letter Template 12

Use the cover letter builder tool and make matching resume’s. Fill in and download yours. Easy does it.

cover letter builder sample

Cover Letter Template 13

cover letter builder sample

Cover Letter Template 14

cover letter builder sample

Cover Letter Template 15

cover letter builder sample

Cover Letter Template 16

cover letter builder sample

Cover Letter Template 17

cover letter builder sample

Cover Letter Template 18

cover letter sample

Cover Letter Template 19

cover letter sample

Cover Letter Template 20

Cover letter example nurse

Cover Letter Template 21

cover letter sample

Cover Letter Template 22

cover letter template

Cover Letter Template 23

cover letter sample

Cover Letter Template 24

cover letter template

Cover Letter Template 25

cover letter template

Cover Letter Template 26

cover letter builder tool template

Cover Letter Template 27

How to end a cover letter.

A few good and quick tips on how to end your cover letter strong and convincing.

creative resume example download pdf

Nothing Found

My Resume Templates

Sample Cover Letter for Any Job Application

job application cover letter sample

How useful was this post?

Average rating 4.9 / 5. Vote count: 54

Get this free cover letter sample for any job in Word format now

This free sample cover letter for job applications is ready to download in Word format. A well-written cover letter introduces you to potential employers, providing a glimpse into your personality, skills, and qualifications. This template helps you do that and more. Download it now!

  • File format:  Word (Microsoft)
  • File size:  79 KB
  • Ready-to-use:  fast, easy, and free

free-cover-letter-template-word

According to a recent survey, 83% of recruiters agree that a cover letter with your job application is crucial even today. This official document should not be viewed as an obligation , but rather as a chance to showcase your candidacy to the hiring team.

If you’ve never included a cover letter with your job applications, you should start doing it now.

Here’s a step-by-step guide to writing a persuasive cover letter for job application . Keep reading, as we’ve also included a job application cover letter template to make it easy for you to get started.

Cover Letter example for Job Application (Text Format)

Full Name Address Phone Number Email Address

Hiring Manager’s Full Name Job Title Company Name Company Address

To: Hiring Manager Full Name, Date

Dear Mr./Ms./Mx. Hiring Manager Last Name,

I am writing to express my sincere interest in the (Job Title) position at (Company Name), as posted on (platform where you found the job posting). Qualified with a Bachelor’s degree in (your field) and 6 years of hands-on experience, I am confident that I can positively contribute to your team and drive exceptional results.

In my previous role at (Previous Company), I successfully (mention a key achievement or responsibility relevant to the job you’re applying for).

Furthermore, my (X) years tenure at (Previous Company) has equipped me with a comprehensive understanding of (Industry/Field) best practices. Throughout this remarkable journey, I showcased my strategic thinking and the ability to deliver concrete results by leveraging strong analytical and problem-solving skills.

In terms of soft skills, my excellent communication and interpersonal abilities have fostered positive working relationships with colleagues and clients alike. My adaptability and resilience have been crucial in navigating complex projects and overcoming challenges, ensuring successful outcomes. Additionally, I am proficient in using (Software or tools), enhancing my efficiency and productivity.

I am excited about the opportunity to bring my skills and experience to (Company Name) and contribute to the continued success of your team. Thank you for considering my application. I look forward to the possibility of discussing further how my qualifications align with the needs of your organization.

Please feel free to contact me at (your phone number) or (your email address) to schedule a convenient time for an interview.

Sincerely, Leah Richards

6 Steps To Crafting a Winning Cover Letter for Job Application

Recruiters are busy individuals, so they appreciate cover letters that are clear , structured, and, of course, purposeful. To ensure your application doesn’t end up in the reject pile, follow the steps below to craft a winning cover letter for job application:

1. Research the job you are applying for

Before you begin your job application cover letter, research the company or industry you are applying to. Every job has different requirements; to get noticed by recruiters, it’s crucial to comply with those conditions .

Here are a few things you need to research before starting with your job application cover letter:

  • Job requirements : Read the job description to understand what recruiters seek. Highlight the essential skills or qualities so you can later integrate them into your cover letter.
  • Know the company you’re applying to : Skim through the firm’s website to learn about its long-term goals and culture. If the organization you’re applying to lacks social media handles, you can inquire about them with your friends or colleagues as well.
  • Identify the hiring manager’s name : Addressing the recruiters by their full name indicates that you have invested time to find out who will read your cover letter. To discover the hiring manager’s name, you can refer to the job description, search the company on LinkedIn, or even explore the company’s website.

2. Outline sections of your cover letter for job application

Breaking down your cover letter into sections makes it easier for recruiters to follow . It minimizes confusion and lets them quickly locate key information, such as your qualifications, experiences, and goals.

A compelling cover letter for job application would typically contain several sections, including:

  • Comprehensive header containing your and the employer’s contact information.
  • Formal salutations or greetings.
  • Catchy introductory paragraph.
  • Middle body: containing qualifications, skills, and experiences.
  • Closing paragraph: to thank the recruiter for their time.

3. Sell your abilities in your job application cover letter

When showcasing your skills in a cover letter, it’s crucial to go beyond mere statements and provide concrete evidence to demonstrate your abilities.

An effective approach is identifying the key skills mentioned in the job description. Additionally, select specific examples from your previous experiences that align with the identified accomplishments to strengthen your stance. You can draw on instances from your previous jobs, academic projects, or even extracurricular activities.

Moreover, if you aim to add credibility to your achievements, consider quantifying them . For instance, if you improved a process, mention the percentage of improvement.

Here’s an excellent example of how to utilize the above teachings in a job application cover letter:

“ In my previous role, I spearheaded weekly team meetings, improving communication flow and collaboration among team members. This resulted in a 20% increase in project efficiency, showcasing my ability to convey complex ideas in a clear and concise manner. “

4. Mention your hard and soft skills

Your skills are valuable assets that set you apart from other candidates . Incorporating your expertise into your cover letter clearly demonstrates how you can contribute to the company’s success.

A persuasive job application cover letter example will have the below essential technical skills:

  • Proficiency in programming languages.
  • Data analysis.
  • Know-how of Microsoft Word Suite.
  • Graphic Designing.

In addition to hard skills, your soft skills also play a significant role in conveying your effectiveness in the workplace to recruiters.

As you craft your job application cover letter, consider emphasizing the following soft skills:

  • Ability to convey information clearly, both verbally and in writing.
  • Open to collaborating with others to achieve common goals.
  • Flexible and open to change in the working environment.
  • Capability to identify challenges and develop practical solutions.

5. Prove your enthusiasm to the employers

Highlighting your accomplishments and skills is crucial for a job-winning cover letter . However, another critical element in establishing credibility is expressing enthusiasm to potential employers using impactful action words.

Clearly state why you are excited about the role. Is it the chance to work with a talented team or the alignment between your skills and the job requirements? Be specific .

Here’s an example to make it more clear:

“I am genuinely excited about the prospect of contributing my skills and passion to ABC Company. I am confident that my software development and my enthusiasm for driving innovative solutions make me an ideal fit for your team.”

Moreover, you can also mention specific achievements or projects of the company that inspire you. This demonstrates that you’ve researched and are genuinely interested in the organization.

For instance, you can add:

“ The innovative projects undertaken by ABC Company, particularly the groundbreaking development of the XYZ platform, resonate deeply with my career aspirations. “

6. Close your job application cover letter with the appropriate CTA

Ending your cover letter with a compelling Call to Action (CTA) is crucial in expressing your eagerness for further discussion. Consider the following steps when crafting the ending paragraph of your job application cover letter:

  • Express gratitude : Start by thanking the recruiter for their time and consideration. A simple “ Thank you for your consideration ” is a polite way to express appreciation.
  • Restate your interest : Remind the recruiters that you’re genuinely interested in the job by highlighting how your skills align with what they seek.
  • Showcase eagerness to discuss things further : Clearly express your readiness to discuss your qualifications and skills by providing your contact information.

For instance, you can mention:

“I am eager to further discuss how my skills and experiences align with (Company Name)’s goals. Please feel free to contact me at [your phone number] or [your email address] to schedule a convenient time for an interview.”
  • Conclude with a formal sign-off : Finally, conclude your job application cover letter with a formal salutation such as “ Sincerely, ” followed by your full name.

Job Resume Template

job resume template example

Cover Letter for Job Application Key Takeaways

  • Research the company you’re applying to before crafting your cover letter.
  • Divide your cover letter into five sections: header, salutation, introductory and middle paragraph, and closing body.
  • Instead of mentioning your abilities, sell them to the recruiters using compelling words .
  • Constantly restate your enthusiasm for the role throughout your job application cover letter.
  • Conclude your cover letter by thanking the hiring manager and providing your contact information for further discussions .

Free Resume Templates to Download in Word

cv template design

  • Eviction Notice Forms
  • Power of Attorney Forms Forms
  • Bill of Sale (Purchase Agreement) Forms
  • Lease Agreement Forms
  • Rental Application Forms
  • Living Will Forms Forms
  • Recommendation Letters Forms
  • Resignation Letters Forms
  • Release of Liability Agreement Forms
  • Promissory Note Forms
  • LLC Operating Agreement Forms
  • Deed of Sale Forms
  • Consent Form Forms
  • Support Affidavit Forms
  • Paternity Affidavit Forms
  • Marital Affidavit Forms
  • Financial Affidavit Forms
  • Residential Affidavit Forms
  • Affidavit of Identity Forms
  • Affidavit of Title Forms
  • Employment Affidavit Forms
  • Affidavit of Loss Forms
  • Gift Affidavit Forms
  • Small Estate Affidavit Forms
  • Service Affidavit Forms
  • Heirship Affidavit Forms
  • Survivorship Affidavit Forms
  • Desistance Affidavit Forms
  • Discrepancy Affidavit Forms
  • Guardianship Affidavit Forms
  • Undertaking Affidavit Forms
  • General Affidavit Forms
  • Affidavit of Death Forms

Application Letter

application letter

Sample Generic Job Application form - 9+ Free Documents in Doc ...

Cover letter examples for teacher - 8+ free documents in word, pdf, sample letters - 31+ free documents in pdf, doc.

application letter bundle 1024x530

Download Application Letter Bundle

What is Application Letter?

An Application Letter is a personalized document that accompanies your resume, highlighting your qualifications and enthusiasm for a specific job opening. Unlike a generic cover letter, it addresses the specific requirements of the job, showcasing how your skills and experiences align with the company’s needs. This document is your first chance to make a meaningful connection with a potential employer, making it crucial in the job application process.

Application Letter Format

[Recipient’s Name] [Recipient’s Address] [City, State, Zip Code]

Dear [Recipient’s Name],

Introduction and Position

I am writing to express my interest in the [Job Title] position listed on [Where You Found the Job Posting]. With a [Brief Description of Your Background] and [Years of Experience], I am confident in my ability to contribute effectively to [Company Name].

Qualifications and Experience

Throughout my career, I have demonstrated exceptional [Skill 1], [Skill 2], and [Skill 3] skills. Notably, I [Brief Description of a Relevant Achievement or Project] which [Results Achieved].

Motivation for Applying

I am particularly drawn to this position because [Reason You Are Interested in the Job], and I admire [Something You Like About the Company]. I believe that my background in [Your Field or Area of Expertise] makes me a perfect candidate for this role.

Closing and Call to Action

I have attached my resume for your review and would welcome the opportunity to discuss how my skills and experiences align with the needs of your team. I am available at your convenience for an interview and can be reached at [Your Contact Information].

Thank you for considering my application. I look forward to the possibility of contributing to [Company Name] and am excited about the opportunity to discuss my application in further detail.

[Your Name] [Your Contact Information]

Application Letter Sample

application letter sample

PDF Word Google Docs

Discover how to craft a compelling Application Letter Sample that stands out. Incorporate elements of a Job Application Cover Letter , highlighting your skills, experience, and why you’re the perfect candidate for the position. You should also take a look at our  Example Reference Letter .

Application Letter For Job

application letter for job

An effective Application Letter For Job should be concise yet detailed, showcasing your qualifications and enthusiasm for the role. Include references to a Job Offer Letter as a testament to your previous successes and readiness for new challenges. You should also take a look at our  Recommendation Letter for a Friend .

Application Letter to a Company

application letter to a company

When writing an Application Letter to a Company, personalize your message by expressing your admiration for their work and how your skills can contribute. A mention of a Job Recommendation Letter can add credibility to your application. You should also take a look at our  Proof of Employment Letter .

Best Application Letter for Job Vacancy

best application letter for job vacancy

The Best Application Letter for Job Vacancy connects your unique achievements and aspirations with the company’s goals. Strategically referencing a Job Acceptance Letter can demonstrate your eagerness and history of successful job integrations. You should also take a look at our  Authorization Letter .

More Application Letter Samples

Simple job application letter.

job application letter

Size: 794 KB

Leave Application Letter

leave application letter

Scholarship Application Letter

scholarship application letter

Size: 274 KB

Application Cover Letter

application cover letter

Size: 128 KB

Business Application Letter

business application letter

Size: 338 KB

A Leave Application Letter is to submitted to your employer if you wish to take a break from work. If you are looking for a scholarship for college, most schools would ask for a Scholarship Application Form discussing your academic performance. An Application letter comes in handy when applying for advertised jobs where you possess the necessary qualifications. Additionally, a Business Application Letter is a means of discussing professional matters.

College Application Letter

college application letter

Size: 603 KB

Example of Application Letter

example of application letter

Size: 107 KB

Formal Application Letter

formal application letter

Internship Application Letter

internship application letter

Loan Application Letter

loan application letter

How do I write an application letter?

writing an application letter involves 1024x530

Writing an application letter involves a structured approach to showcasing your qualifications and interest in a position:

  • Header : Start with your contact information, followed by the date and the employer’s details.
  • Introduction : Clearly state the job you’re applying for and where you found the listing. Incorporating a Letter of Interest can make your introduction stand out.
  • Body : Highlight your relevant experience, skills, and why you’re a good fit for the job. Use specific examples to demonstrate your achievements.
  • Conclusion : Express your enthusiasm for the opportunity and mention your desire to discuss further in an interview. A courteous mention of a Job Offer Acceptance Letter anticipates positive outcomes.
  • Formal Closing : End with a professional closing and your signature.

How do you start an application letter for a job sample?

Beginning an application letter effectively can capture the employer’s attention:

  • Greeting : Use a professional salutation with the hiring manager’s name.
  • Opening Line : Introduce yourself and mention the position you’re applying for. Including a brief mention of a Graduate School Recommendation Letter Document can quickly establish credibility.
  • Purpose Statement : Concisely state why you’re writing the letter and how you learned about the job opening.

What are two types of application letters?

Two main types of application letters are:

  • Solicited Application Letters : Written in response to a job advertisement or listing.
  • Unsolicited Application Letters : Sent to a company to inquire about potential job openings, often requiring a proactive mention of a Letter of Intent . You should also take a look at our  Personal Recommendation Letter .

How do I write a simple application letter with no experience?

Crafting an application letter without experience focuses on potential and transferable skills:

  • Introduction : Express your interest in the position and mention how you discovered the job opening.
  • Body : Emphasize your soft skills, education, and any relevant extracurricular activities. Reference any Reference Letter that attests to your character and potential.
  • Closing : Show enthusiasm for the opportunity to learn and contribute. Offer to provide further information or documents, like a Letter of Authorization , if needed. You should also take a look at our  Recommendation Letter .

How many paragraphs should an application letter have?

An application letter should typically have four to five paragraphs:

  • Introduction : Brief introduction and job application purpose.
  • Body Paragraphs (2-3) : Detailed discussion of your qualifications, experience, and how they align with the job requirements. Mentioning a Job Letter of Recommendation here can add value.
  • Conclusion : Reiterate interest and call to action.

What are four goals of a letter of application?

four goals of a letter of application 1024x530

The four main goals of a letter of application are:

  • To Introduce Yourself : Establish who you are and the purpose of your application, potentially highlighting a Letter of Consent for available references.
  • To Highlight Your Relevant Skills and Experience : Align your qualifications with the job requirements.
  • To Demonstrate Your Interest and Enthusiasm for the Role : Show why you’re attracted to the position and the company.
  • To Prompt an Interview : Conclude with a Formal Letter tone that invites further discussion or an interview opportunity.

Does an application letter have a signature?

Yes, an application letter should include a handwritten or digital signature at the end, after the closing salutation, to add a personal touch and authenticity.

What is an application message?

An application message, often seen as a Letter of Recommendation for Employment , communicates your interest in a job, highlighting your skills and experience relevant to the position applied for.

What is a good opening sentence for a cover letter?

A strong opening sentence for a cover letter might reference a Recommendation Letter for Student , starting with, “As highly recommended by [Professor’s Name], I am excited to apply for [Job Title].”

How do you end an application letter?

End an application letter with a professional closing, such as “Sincerely” or “Best regards,” followed by your name and a Teacher Recommendation Letter if applicable to support your application.

Why is an application letter also called a cover letter?

An application letter is called a cover letter because it covers or introduces your resume, detailing how your skills and experiences make you the ideal candidate for the job. You should also take a look at our  Recommendation Letter for Scholarship .

Is it OK to type an application letter?

Yes, it is acceptable and common to type an application letter, ensuring clarity and professionalism. Including a Personal Reference Letter can further personalize and strengthen your application.

In closing, mastering the art of the Application Letter is essential for anyone looking to advance their career. By carefully crafting your letter to reflect your strengths and fit for the role, you set the stage for success. Including a Student Recommendation Letter can further enhance your application, providing a third-party endorsement of your capabilities and character. Our guide, complete with samples, forms, and practical advice, is designed to help you navigate the complexities of job applications, ensuring your skills and potential are showcased effectively.

Related Posts

9+ sample social security application forms - free sample ..., rent application sample - 9+ free documents in word, pdf, sample employment application forms - 12+ free documents in ..., sample target job application - 9+ free documents in word, pdf, sample letter of recommendation for employment - 8+ free ..., sample recommendation letter - 10+ free documents in word, pdf, sample employee verification letter - 8+ free documents in pdf, doc, example reference letters - 9+ free documents in word, pdf, sample rental applications - 8+ free sample, example, format ..., sample letter of authorization form - 9+ free documents in pdf, 5+ sample business letter form, 8+ sample letter of interest forms, 10+ sample letter of consent - free documents in word, pdf, sample recommendation letter for student - free documents in ..., 8+ sample letters of application - 8+ free documents in pdf, doc, 8+ letter of introduction samples, sample job offer acceptance letter - 8+ free documents in doc, letter of recommendation sample - 9+ free documents in pdf, job proposal sample - 8+ free documents in word, pdf.

up_arrow

  • Sample Letters

Application Letter Templates

application-letter

Sending out application letters for jobs , scholarships, student admissions , Job Offer Letters etc is never an easy deal. To make the most of your time you should switch to using the best sample application letter templates now available for free public download. These templates are completely editable, easily manageable, and have neat formatting which draws attention immediately. Using these premium templates increases your chances of being noticed, especially in times of tough competition.

Application Letter

Sample cover letter example - 24+ download free documents in ..., sample cover letter example template - 29+ free documents ..., fax cover letter - 9+ free samples, examples & format, variety of formatting options guarantee uniqueness.

The Letter of Inquiry templates guarantees uniqueness. The formatting options and the fonts add variety to the application letters. You might even find language options in the premium versions of the same. For an easy idea of how to edit and create your own version of the application letters from these templates you can check out the meticulous examples which have been developed from these very templates.

More Reasons to Make Application Letter Templates your Best Choice

application letters 1024x530

Download Application Letter Bundle

Application Letter for a Job Vacancy

[Your Name] [Your Address] [City, State, Zip Code] [Your Email Address] [Your Phone Number] [Date]

[Hiring Manager’s Name] [Company Name] [Company Address] [City, State, Zip Code]

Dear [Hiring Manager’s Name],

I am writing to express my keen interest in the [Job Title] position listed on [where you found the job listing] at [Company Name]. With a [Your Degree] in [Your Major] from [Your University] and over [Number of Years] years of dedicated experience in [Your Field/Industry], I am confident in my ability to contribute effectively to your team and help achieve [Company Name]’s goals.

In my previous role at [Previous Employer], I successfully [mention a major achievement or responsibility that matches the job description], which resulted in [positive outcome]. This experience honed my skills in [mention relevant skills] and taught me the importance of [mention an important quality or requirement of the job posting]. I am particularly drawn to this opportunity at [Company Name] because [mention something you admire about the company or how it aligns with your career goals].

I am enthusiastic about the possibility of bringing my unique talents to the [specific department or team name] at [Company Name]. I am keen to [mention how you plan to contribute to the company or a specific project mentioned in the job description]. My background in [mention any relevant experience or skills] has equipped me with a solid foundation that allows me to tackle challenges creatively and effectively.

I am eager to bring my passion for [mention an aspect of your field or industry] and my commitment to excellence to your esteemed company. I am convinced that my proactive approach and unwavering dedication would make a significant contribution to the success of [Company Name].

Thank you for considering my application. I am looking forward to the opportunity to discuss how my background, skills, and enthusiasms align with the needs of your team. I am available at your convenience for an interview and can be reached at [Your Phone Number] or via email at [Your Email Address].

Warm regards,

[Your Name]

application letter for a job vacancy

Download In

Pdf Word Google Docs

Application Letter for a Form 1 Place

[Your Name] [Your Address] [City, State, Zip Code] [Your Email Address] [Date]

[Principal’s Name] [School Name] [School Address] [City, State, Zip Code]

Dear [Principal’s Name],

I am writing to express my earnest interest in securing a place for Form 1 at [School Name] for the upcoming academic year. After thorough research and consideration, I am convinced that [School Name]’s commitment to academic excellence, coupled with its emphasis on holistic development, aligns perfectly with my educational aspirations and values.

The reason for choosing [School Name] is multifaceted. Firstly, the school’s reputation for fostering a nurturing yet challenging environment is something that resonates deeply with me. I am particularly drawn to the diverse extracurricular activities and the strong support system for students that [School Name] proudly offers. Furthermore, the success stories of [School Name]’s alumni and the positive feedback from the community have greatly influenced my decision, reinforcing my belief that [School Name] is where I can thrive academically and personally.

On a personal note, I believe that my qualities and aspirations make me a suitable candidate for [School Name]. I am a diligent and curious student, always eager to explore new ideas and take on challenges that enhance my learning. My academic records reflect my commitment to excellence, consistently achieving high grades and actively participating in class discussions. Beyond academics, I am passionate about community service and sports, participating in various volunteer programs and representing my current school in athletics. These experiences have not only honed my leadership and teamwork skills but have also instilled in me the importance of resilience and hard work.

I am excited about the opportunity to contribute to and grow within the vibrant community at [School Name]. I am confident that my personal qualities and dedication to personal and academic growth align with the values and expectations of [School Name]. I eagerly look forward to the possibility of joining the esteemed student body and embarking on a journey of learning and self-discovery at your prestigious institution.

Thank you for considering my application. I am hopeful for the opportunity to discuss my application further and share how I can contribute to the [School Name] community. Please do not hesitate to contact me at [Your Phone Number] or via email at [Your Email Address] for any additional information or to arrange an interview.

application letter for a form 1 place

PDF Word Google Docs

Application Letter to a Company

[Recipient’s Name] [Position Title] [Company Name] [Company Address] [City, State, Zip Code]

Dear [Recipient’s Name],

I am writing to express my interest in the [Position Title] position at [Company Name], as advertised on [where you found the job listing]. With a robust background in [Your Field/Industry], including significant experience in [Specific Experience Related to the Job], I am excited about the opportunity to contribute to your team and support the growth and success of [Company Name].

During my tenure at [Previous Company Name], I successfully [mention a significant achievement, project, or responsibility that aligns with the job requirements], which not only led to [Positive Outcome] but also honed my skills in [Specific Skills Relevant to the Job]. My role involved [Brief Description of Your Role and Responsibilities], which closely aligns with the job description for the [Position Title] at [Company Name]. I am particularly drawn to this opportunity at [Company Name] because of [mention something you admire about the company or how it aligns with your career goals].

My academic background includes [Your Degree] from [Your University], where I specialized in [Your Major/Specialization]. This academic foundation, combined with my practical experience, has equipped me with the knowledge and skills necessary to excel in a dynamic and challenging environment like [Company Name]. I am especially impressed by [Company Name]’s commitment to [mention any known company initiative, values, or projects], and I am eager to bring my expertise in [Your Field/Industry] to contribute to these efforts.

I am known for my [mention one or two personal qualities or soft skills], which enable me to effectively collaborate with teams and manage projects with efficiency and a forward-thinking approach. I am enthusiastic about the possibility of bringing my unique blend of skills and experience to the [Position Title] position at [Company Name].

I am looking forward to the opportunity to further discuss how I can contribute to the success of [Company Name]. I am available for an interview at your earliest convenience and can be reached at [Your Phone Number] or [Your Email Address]. Thank you for considering my application. I am eager to offer my creativity and hard work to a prestigious company like [Company Name] and contribute to its continued success and innovation.

application letter to a company

Application Letter For Internship

[Recipient’s Name or Hiring Manager’s Name] [Company Name] [Company Address] [City, State, Zip Code]

Dear [Recipient’s Name or Hiring Manager’s Name],

I am writing to express my enthusiastic interest in the internship position within the [Specific Department or Field, e.g., Marketing Department] at [Company Name], as advertised on [where you found the internship listing, e.g., your university’s career services website]. As a [Your Current Education Status, e.g., third-year student] pursuing a degree in [Your Major] at [Your University], I am eager to apply my academic knowledge to real-world projects and gain hands-on experience in a dynamic and innovative environment like [Company Name].

Throughout my academic career, I have been committed to exploring [mention any relevant fields or subjects related to the internship], which has led me to take on various projects and coursework that align with [Company Name]’s mission [mention the mission or type of projects if known]. For instance, [mention a specific project, achievement, or experience that relates directly to the internship, detailing what you did, what skills you used or developed, and what the outcome was].

My experience includes [mention any relevant work, volunteer experience, or extracurricular activities], where I developed [mention specific skills related to the internship, e.g., strong analytical skills, project management, communication skills]. These opportunities have equipped me with a solid foundation in [mention relevant areas, e.g., digital marketing strategies, software development life cycle] and an understanding of the importance of [mention any relevant soft skills or values, e.g., teamwork, innovation].

I am particularly drawn to this internship at [Company Name] because [mention why you are interested in this company or organization, referencing any specific initiatives, projects, or values that excite you]. I am impressed by [Company Name]’s commitment to [mention any known company initiatives, values, or projects], and I am enthusiastic about the opportunity to contribute to such impactful work.

I am eager to bring my background in [Your Major] and my [mention any specific skills or qualities] to the [Specific Department or Field] team at [Company Name]. I am confident that my proactive approach and dedication to learning will make me a valuable asset to your team. This internship represents an exciting opportunity for me to further develop my skills, contribute to meaningful projects, and gain invaluable experience in the field of [mention the field or industry related to the internship].

Thank you for considering my application. I look forward to the possibility of discussing this exciting opportunity with you. I am available for an interview at your convenience and can be reached at [Your Phone Number] or [Your Email Address].

application letter for internship

Browse More Templates On Application Letter

Job application letter sample word (doc).

free job application letter for accountant assistant template

  • Google Docs

Job Application Letter Sample PDF

formal job application letter template

Job Application Letter Sample

application letter template for a job vacancy

Teacher Job Application Letter Download

application letter for teacher job for fresher template

Application Letter Download

membership application letter template

See More :   Formal Letters

Application Letter Sample For Any Position Editable

application letter sample

What is a letter of application PDF?

A letter of application PDF refers to a job application letter or cover letter that is in the Portable Document Format (PDF). PDF is a widely used file format that preserves the formatting and layout of a document, ensuring that it appears the same across different devices and operating systems. In the context of a job application, a letter of application PDF typically includes a professionally crafted document introducing the applicant, expressing interest in a specific position, highlighting qualifications, and providing additional information that supports the candidacy. This PDF format ensures that the document is easily shareable and maintains its intended appearance.

Editable Application Letter

application letter format

School Application Letter

college application letter

Application Letter Editable

application letter template

How do you end an application letter?

Ending an application letter requires a professional and positive closing. Here are some common and effective ways to conclude an application letter:

  • Formal Closing:  “Sincerely,”
  • Professional Closing:  “Best regards,”
  • Polite Closing:  “Kind regards,”
  • Thankful Closing:  “Thank you for considering my application,”
  • Confident Closing:  “I look forward to the opportunity to discuss my application further,”
  • Appreciative Closing:  “I appreciate your time and consideration,”
  • Enthusiastic Closing:  “Excited about the possibility of contributing to [company/organization],”
  • Grateful Closing:  “Grateful for your attention to my application,”
  • Respectful Closing:  “Respectfully,”
  • Complimentary Closing:  “Thank you for your consideration. Your time is greatly appreciated.”

Remember to follow the closing with your full name and, if applicable, your contact information. Keep the tone professional and aligned with the overall style of your application letter.

application letter for teaching position

Is cover letter and application letter the same?

The terms “cover letter” and “application letter” are often used interchangeably, but they can have slightly different nuances depending on regional and industry preferences. In general, both refer to a formal document submitted along with a job application to provide additional information about the applicant’s qualifications, skills, and interest in the position. The primary purpose is to complement the simple resume and showcase how the applicant’s experiences align with the requirements of the job.

Some people use “cover letter” to refer specifically to a letter that introduces and “covers” the contents of the job application, while “application letter” might be seen as a broader term encompassing any sample letter submitted with an application, including cover letters. However, the distinction between the two is not universally agreed upon, and many people use these terms interchangeably.

Free Editable Application Letter

scholarship application letter

Sample Format Cover Letter

sample format cover letter

How to Write an Application Letter?

how to write an application letter 1024x530

Writing an application letter, often referred to as a cover letter, is a crucial step in the job application process. It accompanies your resume and provides an opportunity to introduce yourself, highlight your qualifications, and express your interest in the job and the company. Here’s a step-by-step guide on how to write an effective application letter:

1. Research the Company and Position

  • Understand the company’s mission, values, and culture.
  • Familiarize yourself with the job description to tailor your letter accordingly.

2. Start with Personal and Recipient Details

  • Include your contact information at the top: name, address, phone number, and email.
  • Add the date of writing the letter.
  • Address the letter to a specific person, if possible. Use “Dear [Name]” or “Dear Hiring Manager” if the name is unknown.

3. Open with a Strong Introduction

  • Start with a compelling opening line that grabs attention.
  • Mention the job title you’re applying for and where you found the job listing.

4. Highlight Your Qualifications and Experience

  • Link your skills and experiences to what is mentioned in the job description.
  • Use specific examples to demonstrate your accomplishments and how they make you a great fit for the position.

5. Explain Why You’re a Good Fit for the Company

  • Show that you’ve done your homework on the company.
  • Explain why you want to work there and how your values align with the company’s mission.

6. Conclude with a Call to Action

  • Express your enthusiasm for the opportunity to interview.
  • Thank the reader for considering your application.
  • Indicate your availability for an interview and how you can be contacted.

7. Sign Off Professionally

  • Use a professional closing, such as “Sincerely” or “Best regards,” followed by your name.
  • If you’re sending a hard copy, leave space for your handwritten signature above your typed name.

Additional Tips:

  • Customization : Tailor each application letter to the specific job and company. Avoid sending generic letters.
  • Clarity and Conciseness : Keep your letter clear and to the point. A single page is typically sufficient.
  • Professional Tone : Maintain a professional tone throughout the letter. Avoid slang or overly casual language.
  • Proofreading : Carefully proofread your letter for spelling and grammar errors. Consider asking someone else to review it as well.

By following these steps and tips, you can craft an application letter that effectively showcases your qualifications and enthusiasm for the job, making a strong case for why you should be considered for the position.

Job Application Cover Letter

job application cover letter

Application Letter Sample

business application letter

Letter of Application Template

internship application letter

Job Application Letter Sample PDF Free Download

application letter in pdf

Quick Tips for Your Application Letters

quick tips for your application letters 1024x530

  • Keep your letter short.  One of the most frequently asked  cover letter introduction  questions is  “How long should my letter be?”  The answer to this is  one page.  Keep in mind that you are not writing an autobiography. One page would suffice. Just include the necessary details.
  • Follow the appropriate letter format.  An application letter is formal in nature. The best format to follow would be a formal letter format.
  • Use simple and straightforward language.  As mentioned, an application letter is considered to be a formal letter. So keep the language you are using in check and make sure it can be easily comprehended.

What are the 3 types of application letter?

The three main types of application letters are:

  • Cover Letter:  Accompanies a resume during job applications, introducing the applicant and highlighting key qualifications and experiences.
  • Job Application Letter:  Specific to job vacancies, it provides detailed information about the applicant’s skills, experience, and suitability for the position.
  • College Application Letter:  Submitted by students applying to colleges or universities, it outlines academic achievements, extracurricular activities, and personal qualities to demonstrate eligibility for admission. Each type serves a distinct purpose in conveying the applicant’s suitability and interest in a particular opportunity.

1. How to Write a Job Application Letter?

Compose a job application letter by introducing yourself, stating the position you’re applying for, highlighting relevant qualifications and experiences, and expressing enthusiasm for the opportunity.

2. What is the format of application writing?

The format of application writing typically includes a salutation, introduction, body paragraphs highlighting qualifications, a closing statement expressing interest, and a formal closing. Be concise and professional.

3. What is formal letter of application?

A formal letter of application is a written request for employment, admission, or consideration, following a specific structure. It includes details about the applicant’s qualifications, experience, and intent.

4. What is the letter of application with CV?

A letter of application with a CV is a formal document submitted for job applications. It includes a letter introducing the applicant and a Curriculum Vitae (CV) detailing their qualifications and experience.

5. What is personal application writing?

Personal application writing involves crafting a letter or document expressing one’s interest, intent, or request. It could relate to job applications, college admissions, or other personal pursuits requiring formal communication.

6. Is application a part of letter?

Yes, an application is often a part of a letter, specifically in formal contexts like job applications or requests. The application section details the purpose and intent of the letter.

In conclusion, I am eager to bring my skills, passion, and dedication to contribute effectively to your team. Thank you for considering my application. I look forward to the opportunity for an interview to further discuss how my qualifications align with the needs of the position.

If you have any DMCA issues on this post, please contact us!

Related Posts

Sample thank you letters to teacher, sample college letter of intent, sample reference letter templates, sample affidavit of support letter templates, resignation letter with reason samples, sample college acceptance letter templates, sample friendly letter templates, letter of intent for employment samples, letter of support samples & templates, sample business meeting invitation letter templates, sponsorship letter templates, sample contract agreement letter templates, sample proposal request letter templates, sample document request letter templates, sample job appointment letter templates, sample basic cover letter - 8+ examples in word, pdf, sample graphic design cover letter - 8+ examples in word, pdf, sample email cover letter template to download - 11 + free ..., sample letter of recommendation for scholarship - 15+ examples ....

  • Letter Template >

Application Letter Templates

  • Marriage Leave Application Letter Sample
  • Job Application Cover Letter Template Word
  • Letter Of Job Application Template
  • Cover Letter Examples
  • Job Application Letter Format

What is an application letter?

Importance of simple application letter, what are they used for.

  • One is to apply for colleges and into academic programs.
  • And the second is to apply for a job.

Why write an application letter?

  • It provides an excellent medium to convey your interest in the course or the company you would apply for.
  • It is the only means of communication with your reader and a well-written letter can be pretty compelling and might just get you in.
  • A well-versed letter showcases your skills which include your communication skills as well and affirms how you are fit for that position.
  • It is the medium through which you can explain any discrepancies in the documents, for example, a gap year and so on.
  • It helps you to uplift your value to your reader and allows you to market yourself as an asset.
  • The usage of keywords in the application letter grabs the attention of the reader and increases your chances of getting hired as well.
  • It is an only medium through which you can paint a verbal picture of your own self, which if appealing, will create a lasting impression upon its reader and will eventually make them call you back.

Essential elements to include in an application letter

Introduction: state your purpose, body: reveal yourself, concluding paragraph: thank the reader, different types of job application letter, solicited application letter, unsolicited application letter, tips on writing an application letter for job or college.

  • Write an impressive first paragraph. If the beginning is not good, nobody will bother reading till the end.
  • Try to address and highlight your key skills or accomplishments.
  • Keep the tone formal but portray how much the company or the university means to you.
  • Keep it short and restricted to a page.
  • Proofread to ensure it contains no mistake.
  • Maintain a balance between your qualifications and requirements.
  • Request an interview at the end of the letter, without sounding desperate. Keep it dignified.
  • Avoid any negativity as far as possible.

Application letter V.S. cover letter

How to write an application letter.

  • When writing an application letter, start with addressing the person you are writing to. Address them by their name and do not use general salutations like ‘Dear sir’ and so on. If you do not know the name of the person you are writing to, then find out. Call or conduct a web search before you start writing.
  • Start with a strong paragraph and state your reason for writing. The first few sentences should compel them to read on, instead of putting it aside.
  • State your reasons for why you want to get into that college or company. Be honest about it and your letter should reflect a bit of the research you have conducted on it. Be honest about your intentions while at the same time, keep it formal.
  • Talk about yourself and the things you have achieved. Also, state the skills you possess that makes you appropriate and sets you apart from the rest. Reveal a bit about yourself but don’t do so extensively. Highlight your achievements and state only what you have not stated so far.
  • Close it by summarizing and thank the reader before signing it.
  • Once you are done, read and proofread before you send it. Make a third person read the letter and take in suggestions and edit it.

Why use an application letter template?

  • Login to download the PDF.
  • Access your account to see all saved docs.
  • Having trouble downloading PDF files or with the PDF editor? Contact us for support!

WTO / Applications / 22 Free Job Application Forms (Templates) – Word, PDF

22 Free Job Application Forms (Templates) – Word, PDF

A job application form is a formal document containing company-specific questions that employers use to gather information from job applicants.

Employers impose the document on applicants with an aim to get substantial information pertaining to their educational heights, skills, personal attributes, career achievements, and experience in their fields. The forms can unearth things of interest that some candidates may have omitted in their cover letters , resumes, and other submitable documents. These insights help to determine the suitability of every candidate.

Ideal for big companies which receive huge amounts of applications, a job application form gives the hiring team an easier time when it comes to discovering the most deserving candidates. As a result, the hiring team can proceed to the next steps of the screening processes with a more manageable number of candidates. Another reason employers choose to work with job application forms is to eliminate the bias and discrimination that comes with the submitting of other uncontrolled documents. Other than facilitating fairness and consistency, the application form falls in line with federal regulations governing the hiring process for companies.

Free Templates

Free Employment Application Template 01 for Word Document

What to Include

It is your work, as an employer, to prepare a sophisticated job application form depending on the type of your company and the nature of the position in question. Keep in mind that one of the key reasons for crafting an application form is to level the ground as you give yourself an easier time sorting them.

In this context, here are the items that should make up your form:

Personal information

Start by asking the applicant to give their full name and address to let you know who you are evaluating. The applicant should provide the residential address in full (street, state, city, zip code) to streamline her work when conducting the background check . Going on, the applicant should give their contact details (email address and mobile number) for easier communication should you need to call them.

They should submit their social security number to act as proof of citizenship and recognition by the government. If you plan to conduct a physical interview session, ask the applicant to provide a preferred date. Lastly, the interested person should give the preferred payment rate and whether they want to be employed full-time or part-time .

Academic information

To facilitate a sound educational background check, the applicant should list the high school and college attended alongside their addresses. Capturing the dates attended will give you an easier time if you want to call the schools as part of the background check. The form should feature functionality to check if the candidate finished school or not so as to accommodate every applicant.

Leave space for the applicant to indicate if they attended any other additional educational facility and have them provide the address, program pursued, and the corresponding dates. Collecting educational background is vital as it will help you discover how education has prepared the candidate for the role at hand. It may also help gain insights into a person’s commitment and passion for their career.

Employment eligibility

This section is to determine if the potential employee satisfies appropriate employment conditions. The applicant should indicate if they are legally permissible to live and work in the United States without any need for sponsorship. Also, they should add whether they have worked for you in the past and provide more information if the answer is affirmative.

Another check for eligibility should be the criminal background . In this light, the applicant ought to indicate if they have been in conflict with the law, and go ahead to describe the felony, if any. The crime details must include both the crime committed and the consequences.

Employment history

Advise the applicant to provide details pertaining to their previous employments to gain insights on their level of experience and indulgence in their career.

Let them deliberate on the following:

  • Employer (company worked for) and their contact information
  • Payment details from when they started to the time of leaving the company
  • Job title(s) held in their time at the company
  • The powers and duties assigned during the past employment
  • The dates of employment from start to end
  • The reasons behind exit from the company

Note that the candidate should provide the above employment details for all former workplaces if applicable.

Availability

Ask the applicant to state a convenient date on the job application form when they can start working if hired. This is an important piece of information because the best candidate to fill your vacancy may be bound by another contractual agreement requiring them to continue working for their current company, sometimes holding them for weeks or months.

References details

The applicant should provide about 3 references and their referees’ complete information, including their full name, relationship, company, title, and contact details, so you can easily reach them to validate the information.

Additional information

There should be a section for any other information and disclaimers. These could hold important items, such as confirming allegiance to company policies and employment terms. Also, enable a section to add a sign indicating that the applicant has provided correct information to the best of their knowledge.

Has the applicant ever served in the military? If the applicant has served in the military, they should provide details like their veteran status, branch and service rank, induction and dismissal dates, and the reason why they left the army.

Background and criminal check consent

Now that the applicant has provided you with all the information you need to inspect their eligibility for the position, they should grant or deny your authority to conduct a background check on them. Naturally, any employer will give you permission because they know that denying you the same could make you suspicious.

The applicant should end by adding their signature, the date when they completed the form, and their name in print form.

Types Of Job Application Forms

Depending on the kind of employer you are, you can choose any of the following main types.

Online application

Online job application forms are basically forms filled and submitted over the web. You can register with popular job platforms and wait for interested applicants to fill out the form. Alternatively, you can avail yourself of a form on your company website as long as you have a database sizeable enough to hold all the data fed by candidates.

Email application

Popular with remote positions, you can give applicants a chance to prove their suitability by email, whereby applicants fill out forms and answer your questions through emails.

Paper job application form

You may provide applicants with hard copy, company-prepared application forms for them to fill and submit to the hiring committee. You can go ahead to modernize the experience by providing printable forms from your website so that the applicant will print and visit your offices. This is a good option if you want to meet with the candidates right from the start.

Special Considerations

The following are tips to help you craft an effective application form:

Consider using different types of forms

After crafting your role-specific form, consider making it available in different methods. For instance, applicants should be able to download and send via email, fill through your website, or submit physically. This way you can reach more applicants and boost your chances of landing a more qualified employee.

Use job posting sites

Such sites give more exposure to your advertisement because they receive many interested visitors. If you decide to utilize these sites, give the applicants an easy time by letting them send everything online either through the job platform or via email.

Ensure that applicants satisfy what you are looking for

In the end, the goal is to hire the most qualified candidate for the job. You can achieve this by contrasting answers against the job description when it comes to skills and experience.

Don’t waste time

Go through applications as fast as you can to weed out those that do not meet your standards. This way, you can spend more time arranging and conducting the next screening process for the most deserving candidates.

Discover your ideal candidates

After listing all the best-qualified applicants, check them in more detail and compare their answers closely in order to choose an ideal number to call in for interviews.

File the best applications

Keep all the impressive applications so that you can reconsider them the next time you want to hire.

Downloadable Job Application Form 05 for Word Document

Frequently Asked Questions

Sometimes collecting resumes, cover letters, and CVs can be enough, but application forms are an even better way to level the ground and judge everyone from a common point of view.

You can still use only resumes and CVs to make your decision, but a form will always facilitate the process as you only get to see what you want. Also, a manager’s position is a sensitive area for your business that requires an equally sensitive hiring process..

There are no specific rules dictating what you should include in your application form. However, it should capture personal information so that you are able to conduct a background check. Other areas include skills, qualifications, and experience pertinent to the position in question. You can even ask for hobbies as it may lead you to discover hidden talents and skills that could prove beneficial..

About This Article

William Lehr

Was this helpful?

Great! Tell us more about your experience

Not up to par help us fix it, keep reading.

Employee complaint

Forms , Human Resource

Free employee complaint forms (what to include).

Writing interview reschedule email

Letters and Emails

Reschedule interview email (how to write) – examples.

Application Letter

Cover Letters , Letters and Emails

How to write a job application letter (30 best examples).

Part Time Job

Employment , Guides

Exactly how many hours is a part-time job.

Employee Disciplinary Action Form

Employment , Human Resource

Free employee disciplinary action forms (word | pdf).

Writing employee recommendation letter

Letters and Emails , Recommendation

40 good examples of employment recommendation letters.

Job Description

26 Free Job Description Templates (Guide with Examples)

Workplace Communication Skills

14 Top Workplace Communication Skills and How to Improve

Invisalign consent form

Consent , Forms , Legal

Free invisalign informed consent forms (us) word | pdf.

Massachusetts Bill of Sale

Bill of Sale , Forms , Legal

Free massachusetts bill of sale form for vehicle/boat.

Manager Resume

20 Manager Resume Examples: Format, Skills, Templates

Maryland Last Will and Testament Template

Forms , Last Will & Testament

Maryland last will and testament (free template – form), thank you for your feedback.

Your Voice, Our Progress. Your feedback matters a lot to us.

  • CV Templates
  • Cover Letter Samples
  • Aptitude Tests
  • Interview Questions

Free Cover Letter Samples. Download in PDF & Word.

Looking for a sample cover letter for your job application? Explore our professionally written cover letter samples for over 1600+ job titles, to inspire you and help you get started with your own cover letter. Our cover letter samples will give you insight into how other professionals market their accomplishments and skills to make lasting impressions on recruiters. These cover letter examples are free for use and can be downloaded in PDF and Microsoft Word format.

U.S. flag

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure Website

Secure .gov websites use HTTPS A lock ( A locked padlock ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

  • Create Account

I-131F, Application for Parole in Place for Certain Noncitizen Spouses and Stepchildren of U.S. Citizens

ALERT: On Aug. 26, 2024, the United States District Court for the Eastern District of Texas, in Texas v. Department of Homeland Security,  Case Number 24-cv-306 administratively stayed DHS from granting parole in place under Keeping Families Together for 14 days.

To comply with the district court’s administrative stay, USCIS will:

  • Not grant any pending parole in place requests under Keeping Families Together.
  • Continue to accept filings of Form I-131F, Application for Parole in Place for Certain Noncitizen Spouses and Stepchildren of U.S. Citizens.
  • Continue to schedule biometric appointments and capture biometrics at Application Support Centers (ASCs).

The district court’s administrative stay order does not affect any applications that were approved before the administrative stay order was issued at 6:46 p.m. Eastern Time on Aug. 26, 2024.

Use this form to request a discretionary grant of parole in place under  Keeping Families Together .

Image of computer with a list of Online Filing Benefits

What This Form Can Help You Do

  • Keeping Families Together

Frequently Asked Questions About Keeping Families Together

Form Details

Form I-131F must be filed online.

File Online

You can find the filing fee for Form I-131F by visiting our  Fee Schedule  page. There is no fee waiver available for Form I-131F.

Starting Aug. 19, 2024, you may file Form I-131F, Application for Parole in Place for Certain Noncitizen Spouses and Stepchildren of U.S. Citizens, online with the applicable filing fee. There is no fee waiver available for Form I-131F.

Each requestor, including noncitizen stepchildren, must file a separate Form I-131F requesting parole in place, and each requestor must have their own USCIS online account. A parent or legal guardian may create an online account for their minor child if the purpose is to submit a form on behalf of the minor. If a parent or legal guardian is not available, a primary caregiver or legal assistance provider may also help a child create their own USCIS online account. Information on creating a USCIS online account is available on the  How to Create a USCIS Online Account page.

  • Frequently Asked Questions About the Keeping Families Together Process
  • Form I-131F Filing Guide (PDF, 8.95 MB)

Filing Online

  • How to Create a USCIS Online Account
  • Tips for Filing Forms Online
  • Online Filing for Attorneys and Accredited Representatives

U.S. flag

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Free Cyber Services #protect2024 Secure Our World Shields Up Report A Cyber Issue

Vulnerability Summary for the Week of August 19, 2024

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the  National Institute of Standards and Technology  (NIST)  National Vulnerability Database  (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the  Common Vulnerabilities and Exposures  (CVE) vulnerability naming standard and are organized according to severity, determined by the  Common Vulnerability Scoring System  (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High : vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium : vulnerabilities with a CVSS base score of 4.0–6.9
  • Low : vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.  

High Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource InfoPatch Info
Liquid Web--GiveWP
 
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.2024-08-19
 
webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform
 
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.2024-08-20







 
sjhoo--Woo Inquiry

 
The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-21

 
Forcepoint--Web Security

 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.2024-08-22
 
Joomla! Project--Joomla CMS

 
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.2024-08-20
 
LiteSpeed Technologies --LiteSpeed Cache

 
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.2024-08-21

 
SolarWinds--Web Help Desk

 
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.2024-08-21

 
newlib_project -- newlib
 
An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function.2024-08-20


 
N/A -- N/A

 
A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.2024-08-23

 
N/A -- N/A

 
A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.2024-08-23

 
n/a--n/a
 
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges.2024-08-20
 
typecho -- typecho
 
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.2024-08-20
 
N/A -- N/A

 
Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password.2024-08-22

 
N/A -- N/A

 
Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.2024-08-22

 
Azure--Microsoft Managed Instance for Apache Cassandra
 
An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.2024-08-20
 
squirrelly -- squirrelly
 
squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName.2024-08-21


 
hargal -- hargal_windows_client
 
Hargal - CWE-284: Improper Access Control2024-08-20
 
N/A -- N/A

 
Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific set of URLs that can be used to redirect the camera feed.2024-08-23

 
n/a--n/a
 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_removed.php.2024-08-20
 
n/a--n/a
 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.2024-08-20
 
n/a--n/a
 
An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid password.2024-08-20
 
n/a--n/a
 
Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview.php.2024-08-20
 
n/a--n/a
 
An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file.2024-08-20
 
n/a--n/a
 
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.2024-08-20
 
n/a--n/a
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php.2024-08-20
 
n/a--n/a
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.2024-08-20
 
arajajyothibabu -- school_management_system
 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php.2024-08-20
 
nepstech -- ntpl-xpon1gfevn_firmware
 
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter2024-08-19


 
N/A -- N/A

 
Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.2024-08-23

 
N/A -- N/A

 
A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.2024-08-23

 
N/A -- N/A

 
An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.2024-08-22

 
lopalopa -- music_management_system
 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-08-21
 
lopalopa -- music_management_system
 
A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter.2024-08-21

 
lopalopa -- music_management_system
 
A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter.2024-08-21

 
N/A -- N/A

 
A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.2024-08-21

 
n/a--n/a
 
In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.2024-08-19
 
n/a--n/a
 
In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.2024-08-19
 
Apache Software Foundation--Apache DolphinScheduler
 
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.2024-08-20



 
azzaroco--Ultimate Membership Pro
 
Improper Privilege Management vulnerability in azzaroco Ultimate Membership Pro allows Privilege Escalation.This issue affects Ultimate Membership Pro: from n/a through 12.6.2024-08-19
 
azzaroco--Ultimate Membership Pro
 
Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro allows Object Injection.This issue affects Ultimate Membership Pro: from n/a through 12.6.2024-08-19
 
eyecix--JobSearch
 
Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.2024-08-19
 
Bit Apps--Bit Form Pro
 
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.2024-08-19
 
Crew HRM--Crew HRM
 
Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.2024-08-19
 
Hamed Naderfar--Compute Links
 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hamed Naderfar Compute Links allows PHP Remote File Inclusion.This issue affects Compute Links: from n/a through 1.2.1.2024-08-19
 
Geek Code Lab--Login As Users
 
Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4.2.2024-08-19
 
myCred--myCred
 
Deserialization of Untrusted Data vulnerability in myCred allows Object Injection.This issue affects myCred: from n/a through 2.7.2.2024-08-19
 
opensecurity -- mobile_security_framework
 
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.2024-08-19

 
NicPWNs--MEGABOT
 
MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.2024-08-20




 
frrouting -- frrouting
 
An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.2024-08-19
 
microcks -- microcks
 
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.2024-08-19


 
N/A -- N/A

 
The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username (such as root), or can send arbitrary data.2024-08-22


 
N/A -- N/A

 
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. There is an access violation and EIP overwrite after five logins.2024-08-22




 
N/A -- N/A

 
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. A certain XmlMessage document causes 100% CPU consumption.2024-08-22





 
N/A -- N/A

 
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, communication endpoints are not verifiable.2024-08-22




 
N/A -- N/A

 
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution via the \xB0\x00\x3c byte sequence.2024-08-22




 
N/A -- N/A

 
An issue was discovered in Matrix libolm (aka Olm) through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to software that uses a lookup table for the SubWord step. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.2024-08-22



 
bdthemes--Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider

 
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up to , and including, 1.6.4. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.2024-08-21


 
Unknown--GEO my WP
 
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.2024-08-19
 
WPML--WPML

 
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.2024-08-21


 
Unknown--Chatbot with ChatGPT WordPress
 
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.2024-08-20
 
brandondove--Favicon Generator (CLOSED)

 
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin.2024-08-24

 
bitpressadmin--Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
 
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).2024-08-20




 
jielink\+_jsotc2016_project -- jielink\+_jsotc2016
 
A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue affects some unknown processing of the file /report/ParkChargeRecord/GetDataList. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
jielink\+_jsotc2016_project -- jielink\+_jsotc2016
 
A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is an unknown function of the file /Report/ParkCommon/GetParkInThroughDeivces. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
jielink\+_jsotc2016_project -- jielink\+_jsotc2016
 
A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
dell -- dns-120_firmware
 
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function cgi_audio_search/cgi_create_playlist/cgi_get_album_all_tracks/cgi_get_alltracks_editlist/cgi_get_artist_all_album/cgi_get_genre_all_tracks/cgi_get_tracks_list/cgi_set_airplay_content/cgi_write_playlist of the file /cgi-bin/myMusic.cgi. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-19





 
project_expense_monitoring_system_project -- project_expense_monitoring_system
 
A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been classified as critical. Affected is an unknown function of the file login1.php of the component Backend Login. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
project_expense_monitoring_system_project -- project_expense_monitoring_system
 
A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file execute.php. The manipulation of the argument code leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
project_expense_monitoring_system_project -- project_expense_monitoring_system
 
A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file print.php. The manipulation of the argument map_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
adonesevangelista -- online_blood_bank_management_system
 
A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file register.php of the component User Signup. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
janobe -- point_of_sales_and_inventory_management_system
 
A vulnerability classified as critical has been found in SourceCodester Point of Sales and Inventory Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
SPIP--SPIPThe porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.2024-08-23


 
gotribe -- gotribe-admin
 
A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as 45ac90d6d1f82716f77dbcdf8e7309c229080e3c. It is recommended to apply a patch to fix this issue.2024-08-20





 
demozx -- gf_cms
 
A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b38139c827458a5. It is recommended to upgrade the affected component.2024-08-20






 
Cisco--Cisco Unifed Communications Manager

 
A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a crafted SIP message to an affected Cisco Unified CM or Cisco Unified CM SME device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition that interrupts the communications of reliant voice and video devices.2024-08-21
 
N/A -- N/A

 
cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system.2024-08-22

 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module.2024-08-23
 
Collabora Online--Online

 
Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora Online 24.04.4.3, 23.05.14.1, and 22.05.23.1.2024-08-23
 
Dell--Dell Power Manager

 
Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.2024-08-22
 
projectcapsule -- capsule
 
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace.2024-08-20

 
N/A -- N/A

 
A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.2024-08-23

 
mattermost -- mattermost
 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.2024-08-22
 
Casdoor--Casdoor

 
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.2024-08-20

 
usememos--memos

 
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.2024-08-20


 
Servision--Servision IVG Webmax 1.0.57
 
Servision - CWE-287: Improper Authentication2024-08-20
 
Apache--Hertzbeat

 
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.2024-08-20





 

Zendesk--Samson
 
Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.2024-08-20





 
n/a--n/a
 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_history.php.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.2024-08-20
 
n/a--n/a
 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_added.php.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.2024-08-20
 
n/a--n/a
 
Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at sales_report.php.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
siamonhasan -- warehouse_inventory_system
 
A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=32024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=12024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=12024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete2024-08-20
 
N/A -- N/A

 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=322024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma2024-08-20
 
N/A -- N/A

 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg.com2024-08-20
 
pligg -- pligg_cms
 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php2024-08-20
 
linksys -- e1500_firmware
 
A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an authenticated attacker can execute OS commands with root privileges.2024-08-19
 
lopalopa -- music_management_system
 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-08-21

 
lopalopa -- music_management_system
 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-08-21

 
lopalopa -- music_management_system
 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.2024-08-21

 
N/A -- N/A

 
A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page.2024-08-21

 
N/A -- N/A

 
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.2024-08-23

 
N/A -- N/A

 
DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi.2024-08-21
 
N/A -- N/A

 
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2024-32358.2024-08-22


 
Crocoblock--JetGridBuilder
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This issue affects JetGridBuilder: from n/a through 1.1.2.2024-08-19
 
WP OnlineSupport, Essential Plugin--Timeline and History slider
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.2024-08-19
 
creativeon--WHMpress
 
Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.2024-08-19
 
Bit Apps--Bit Form Pro
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.2024-08-19
 
Themelocation--Woo Products Widgets For Elementor
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Local File Inclusion.This issue affects Woo Products Widgets For Elementor: from n/a through 2.0.0.2024-08-19
 
WPDeveloper--EmbedPress
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.2024-08-19
 
-- xwiki
 
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a user with elevated rights to edit a content with a malicious payload using a WYSIWYG editor. The user with elevated rights is not warned beforehand that they are going to edit possibly dangerous content. The payload is executed at edit time. This vulnerability has been patched in XWiki 15.10RC1.2024-08-19












 
kanisterio--kanister

 
Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding. The "edit" ClusterRole is one of Kubernetes default-created ClusterRole, and it has the create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. A malicious user can leverage access the worker node which has this component to make a cluster-level privilege escalation.2024-08-20

 
lf-edge--ekuiper
 
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.2024-08-20

 
n/a--n/a
 
The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations, aka GhostWrite.2024-08-19
 
N/A -- N/A

 
D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.2024-08-23

 
N/A -- N/A

 
D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function.2024-08-23

 
N/A -- N/A

 
Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset.2024-08-23
 
Manage Engine--OpManager, Remote Monitoring and Management

 
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.2024-08-23
 
Manage Engine--ADAudit Plus

 
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option.2024-08-23
 
zen-cart -- zen_cart
 
Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability. The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of user-supplied data prior to passing it to a PHP include function. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-21408.2024-08-21

 
Red Hat--Red Hat Open Container Platform 4

 
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim's current application account using a third-party account without any restrictions.2024-08-21

 
aukejomm--woocommerce google feed manager

 
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).2024-08-23




 
magnetforensics -- axiom
 
Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device. The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23964.2024-08-21

 
File Manager--File Manager Pro

 
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.2024-08-23

 
logsign -- unified_secops_platform
 
Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-25025.2024-08-21

 
logsign -- unified_secops_platform
 
Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-25026.2024-08-21

 
logsign -- unified_secops_platform
 
Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete directories in the context of root. Was ZDI-CAN-25028.2024-08-21

 
levantoan--imagine hotspot by devvn

 
The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvn_ihotspot_shortcode_func' function. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.2024-08-24


 
bitpressadmin--Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
 
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).2024-08-20

 
autel -- maxicharger_ac_elite_business_c50_firmware
 
Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AppAuthenExchangeRandomNum BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23384.2024-08-21
 
levelfourstorefront--Shopping Cart & eCommerce Store
 
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'model_number' parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-20



 
oretnom23 -- clinic_patient_management_system
 
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pms/ajax/get_packings.php. The manipulation of the argument medicine_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
tamparongj_03 -- online_graduate_tracer_system
 
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects some unknown processing of the file /tracking/admin/view_csprofile.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
adonesevangelista -- laravel_property_management_system
 
A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsRequest of the file DocumentsController.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
tamparongj_03 -- online_graduate_tracer_system
 
A vulnerability, which was classified as critical, was found in SourceCodester Online Graduate Tracer System up to 1.0. Affected is an unknown function of the file /tracking/admin/fetch_genderit.php. The manipulation of the argument request leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-20




 
google -- chrome
 
Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
Google--ChromeInappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
google -- chrome
 
Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
Google--Chrome

 
Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
google -- chrome
 
Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
google -- chrome
 
Type Confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
Google--Chrome

 
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)2024-08-21

 
Google--Chrome

 
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)2024-08-21

 
Google--Chrome

 
Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium)2024-08-21

 
google -- chrome
 
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)2024-08-21

 
redhat -- openstack_platform
 
A flaw was found in the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.2024-08-21

 
TOTOLINK--AC1200 T8

 
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this issue is the function setDiagnosisCfg. The manipulation leads to buffer overflow. The attack may be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-22



 
TOTOLINK--AC1200 T8

 
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been declared as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to buffer overflow. The attack can be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-22



 
TOTOLINK--AC1200 T8

 
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been rated as critical. This issue affects the function exportOvpn. The manipulation leads to buffer overflow. The attack may be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-22




 
microfocus -- netiq_privileged_access_manager
 
A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricted access to all the application resources. This issue affects Privileged Access Manager before 3.7.0.1.2024-08-21
 
microfocus -- netiq_privileged_access_manager
 
SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.2024-08-21
 
adegans--AdRotate Banner Manager The only ad manager you'll need
 
The AdRotate Banner Manager - The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.2024-08-20

 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Do not change route.addr.src_addr outside state checks If the state is not idle then resolve_prepare_src() should immediately fail and no change to global state should happen. However, it unconditionally overwrites the src_addr trying to build a temporary any address. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) Which would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae This is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address derived from the dst build one explicitly on the stack and bind to that as any other normal flow would do. rdma_bind_addr() will copy it over the src_addr once it knows the state is valid. This is similar to commit bc0bdc5afaa7 ("RDMA/cma: Do not change route.addr.src_addr.ss_family")2024-08-22



 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c2024-08-22







 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indio_dev->num_channels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channels. So, fix memory corruption by ARRAY_SIZE() instead of num_channels variable. Note the first case is a cleanup rather than a fix as the software timestamp channel bit in active_scanmask is never set by the IIO core.2024-08-22


 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 00000000000010002024-08-22



 
dell -- repository_manager
 
Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker may potentially exploit this vulnerability leading to the execution of arbitrary executable on the operating system with high privileges using the existing vulnerability in operating system. Exploitation may lead to unavailability of the service.2024-08-21
 
N/A -- N/A

 
Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library.2024-08-21


 
apache -- seatunnel
 
Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version [1.0.1], which fixes the issue.2024-08-21
 
Joomla! Project--Joomla! CMS

 
Improper Access Controls allows backend users to overwrite their username when disallowed.2024-08-20
 
google -- android
 
In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2024-08-19
 
AMI--AptioV

 
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbitrary code execution, and bypassing OS security mechanisms2024-08-21
 
AMI--AptioV

 
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading to denial-of-service attacks.2024-08-21
 
keyfactor -- command
 
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.2024-08-20
 
N/A -- N/A

 
Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP.2024-08-22

 
autodesk -- revit
 
A maliciously crafted DWG file, when parsed in Revit, can force a stack-based buffer overflow. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.2024-08-21
 
Microsoft--Microsoft Edge Chromium-based

 
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2024-08-22
 
Microsoft--Microsoft Edge Chromium-based

 
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2024-08-22
 
Dell--SupportAssist for Home PCs

 
Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.2024-08-21
 
ibm -- sterling_connect_direct_web_services
 
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.2024-08-22

 
Avtec--Outpost 0810

 
Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.2024-08-22
 
Barix--Barix SIP Client Web Management Interface UI
 
Barix - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor2024-08-20
 
keyfactor -- aws_orchestrator
 
Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.2024-08-20
 
Apache--Hertzbeat

 
Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.2024-08-20



 
Avtec--Outpost 0810

 
Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information.2024-08-22
 
goauthentik--authenik

 
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue.2024-08-22


 
N/A -- N/A

 
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData2024-08-23

 
n/a--n/a
 
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete.2024-08-20
 
N/A -- N/A

 
DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.2024-08-23
 
nepstech -- ntpl-xpon1gfevn_firmware
 
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process2024-08-19


 
N/A -- N/A

 
Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.2024-08-22

 
N/A -- N/A

 
An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section.2024-08-22

 
N/A -- N/A

 
An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.2024-08-22

 
N/A -- N/A

 
Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.2024-08-22

 
N/A -- N/A

 
A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.2024-08-21

 
N/A -- N/A

 
An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal.2024-08-21
 
Bit Apps--Bit Form Pro
 
Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bit Form Pro: from n/a through 2.6.4.2024-08-19
 
nouthemes--Leopard - WordPress offload media
 
Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.2024-08-19
 
PluginOps--Landing Page Builder
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.2024-08-19
 
floraison -- fugit
 
fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.2024-08-19


 
Eugeny--Russh

 
Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length, russh allocates enough memory for this bytestream, as a performance optimization to avoid reallocations later. But this length is entirely untrusted and can be set to any value by the client, causing this much memory to be allocated, which will cause the process to OOM within a few such requests. This vulnerability is fixed in 0.44.1.2024-08-21

 
Microsoft--Microsoft Entra

 
Improper access control in Decentralized Identity Services allows an unathenticated attacker to disable Verifiable ID's on another tenant.2024-08-23
 
openedx--openedx-translations

 
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.2024-08-23


 
steveklabnik--request_store

 
RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.2024-08-23
 
rust-bitcoin -- miniscript
 
The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.2024-08-19


 
hex-rays -- ida_pro
 
ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where the actual entry point will be invoked. NOTE: in many use cases, this is an inconvenience but not a security issue.2024-08-19
 
N/A -- N/A

 
Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind.2024-08-23
 
N/A -- N/A

 
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server2024-08-23
 
N/A -- N/A

 
An issue was discovered in Matrix libolm (aka Olm) through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.2024-08-22



 
zephyrproject-rtos--Zephyr
 
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero2024-08-19
 
vipre -- advanced_security
 
VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22315.2024-08-21

 
vipre -- advanced_security
 
VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Patch Management Agent. The issue results from loading a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22316.2024-08-21

 
vipre -- advanced_security
 
VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Anti Malware Service. The issue results from incorrect permissions on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22345.2024-08-21

 
windscribe -- windscribe
 
Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windscribe Service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23441.2024-08-21

 
nissan-global -- blind_spot_protection_sensor_ecu_firmware
 
Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.2024-08-19
 
Unknown--AI Engine
 
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.2024-08-19
 
irfanview -- irfanview
 
IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WSQ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24192.2024-08-21
 
irfanview -- irfanview
 
IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WSQ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23273.2024-08-21
 
Schneider Electric--Accutech Manager
 
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutech Manager when receiving a specially crafted request over port 2536/TCP.2024-08-20
 
Panasonic Holdings Corporation--Control FPWIN Pro

 
Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file.2024-08-21

 
liquidpoll -- LiquidPoll – Polls, Surveys, NPS and Feedback Reviews

 
The LiquidPoll - Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_data' parameter in all versions up to, and including, 3.3.78 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-21


 
Autodesk--AutoCAD
 
A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.2024-08-20
 
presstigers -- Simple Job Board

 
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.2024-08-24

 
acyba--acymailing

 
The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.2024-08-22





 
python -- python
 
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.2024-08-19


 
logsign -- unified_secops_platform
 
Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of the user's license expiration date. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25029.2024-08-21

 
bitpressadmin--Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
 
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the entryID parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.2024-08-20

 
bitpressadmin--Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
 
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-20



 
redhat -- build_of_apache_camel_-_hawtio
 
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.2024-08-21

 
zzcms -- zzcms
 
A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of the argument skin leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
zzcms -- zzcms
 
A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
n/a--ZZCMS
 
A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/about_edit.php?action=modify. The manipulation of the argument skin leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
n/a--ZZCMS
 
A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin[] leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
google -- chrome
 
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)2024-08-21

 
Google -- Chrome

 
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)2024-08-21

 
Google -- Chrome

 
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)2024-08-21

 
mattermost -- mattermost
 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.2024-08-22
 
itsourcecode-- Payroll Management System

 
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 
SourceCodester -- E-Commerce System

 
A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommerce/admin/login.php of the component Admin Login. The manipulation of the argument user_email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 
Python Software Foundation-- CPython

 
There is a HIGH severity vulnerability affecting the CPython "zipfile" module. When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.2024-08-22






 

Back to top

Medium Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource InfoPatch Info
microfocus -- netiq_self_service_password_reset
 
Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Reset before 4.5.0.2 and 4.4.0.62024-08-21
 
IBM--App Connect Enterprise Certified Container
 
IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with access to execute commands in a running Pod to elevate their user privileges.2024-08-24

 
themebeez -- Orchid Store

 
The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited.2024-08-24

 
Cisco -- Cisco Identity Services Engine Software

 
Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these vulnerabilities by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the affected device.2024-08-21
 
Cisco--Cisco Identity Services Engine

 
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.2024-08-21
 
Cisco--Cisco Identity Services Engine

 
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.2024-08-21
 
Cisco--Cisco Unified Communications Manager

 
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.2024-08-21
 
risetheme--RT Easy Builder

 
The RT Easy Builder - Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-24

 
heytap -- internet_browser
 
The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript code via the com.android.browser.RealBrowserActivity component.2024-08-19

 
Ericsson--Packet Core Controller
 
Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to denial of service which may result in service degradation.2024-08-20
 
ibm -- openpages_grc_platform
 
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.2024-08-22

 
n/a--n/a
 
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently.2024-08-19

 
N/A -- N/A

 
An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used.2024-08-22

 
Microsoft--Microsoft Edge

 
Microsoft Edge (HTML-based) Memory Corruption Vulnerability2024-08-23
 
Microsoft--Microsoft Edge

 
Microsoft Edge for Android Spoofing Vulnerability2024-08-22
 
Spring--springboot

 
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.2024-08-23
 
spring--spring security
 
Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.2024-08-20
 
Manage Engine--Service Engine Desk Plus

 
An Stored Cross-site Scripting vulnerability affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800.2024-08-23
 
mattermost -- mattermost
 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.2024-08-22
 
Manage Engine--Service Engine Desk Plus


 
An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800.2024-08-23
 
casdoor--casdoor

 
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via wechat pay. When using wechat pay, a QR code with the wechat pay link is displayed on the payment page, hosted on the domain of casdoor. This page takes a query parameter from the url successUrl, and redirects the user to that url after a successful purchase. Because the user has no reason to think that the payment page contains sensitive information, they may share it with other or can be social engineered into sending it to others. An attacker can then craft the casdoor link with a special url and send it back to the user, and once payment has gone though an XSS attack occurs.2024-08-20

 
okfn -- ckan
 
CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.2024-08-21


 
Priority--Priority
 
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)2024-08-20
 
IBM--Global Configuration Management

 
IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls.2024-08-20

 
apache -- airflow
 
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability.2024-08-21

 
gethomepage--homepage

 
Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user's private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website.2024-08-23
 
mattermost--mattermost

 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.2024-08-22
 
n/a--n/a
 
A cross-site scripting (XSS) vulnerability in the component update_page_details.php of Blood Bank And Donation Management System commit dc9e039 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Details parameter.2024-08-20
 
N/A -- N/A

 
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.2024-08-20

 
N/A -- N/A

 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter.2024-08-22

 
N/A -- N/A

 
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php.2024-08-22

 
N/A -- N/A

 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters.2024-08-22

 
N/A -- N/A

 
Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.2024-08-23
 
okfn -- ckan
 
CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All latest versions of the plugins listed above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0.2024-08-21
 
ckeditor -- ckeditor
 
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.2024-08-21


 
discourse--discourse placeholder theme component

 
Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.2024-08-20

 
TryGhost--Ghost
 
Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.2024-08-20

 
opensearch project--security dashboards plugin
 
OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.2024-08-23

 
N/A -- N/A

 
Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet.2024-08-23
 
N/A -- N/A

 
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request2024-08-23
 
N/A -- N/A

 
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request2024-08-23
 
N/A -- N/A

 
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request2024-08-23
 
piotnetdotcom--Piotnet Addons For Elementor

 
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-23




 
themeum--Tutor LMS Elementor Addons
 
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-20





 
posimyththemes--The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce

 
The The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel_direction parameter of testimonials widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-22

 
posimyththemes--The Plus Addons for Elementor Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
 
The The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_date attribute within the plugin's Video widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-20



 
webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform
 
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.2024-08-20



 
averta--phloxpro

 
The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-08-21


 
3ds -- 3dexperience
 
A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.2024-08-20
 
3ds -- 3dexperience
 
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.2024-08-20
 
posimyththemes--The Plus Addons for Elementor Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
 
The The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'res_width_value' parameter within the plugin's tp_page_scroll widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-20



 
Unknown--Chatbot with ChatGPT WordPress
 
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins2024-08-19
 
infosatech--WP Last Modified Info
 
The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'template' attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-20




 
dfactory--responsive lightbox & gallery

 
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.2024-08-22



 
elbanyaoui--Smart Online Order for Clover

 
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to deactivate the plugin and drop all plugin tables from the database.2024-08-21


 
danieliser--Popup Maker Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder
 
The Popup Maker - Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'close_text' parameter in all versions up to, and including, 1.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-08-20

 
shawfactor--LH Add Media From URL

 
The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lh_add_media_from_url-file_url' parameter in all versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-08-21


 
Gitlab--Gitlab

 
An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.2024-08-22
 
logsign -- unified_secops_platform
 
Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-25027.2024-08-21

 
marla14--responsive video

 
The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires responsive videos to be enabled for posts.2024-08-21

 
otasync--OTA Sync Booking Engine Widget

 
The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasync_widget_settings_fnc() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-21

 
themeisle--orbit fox by themeisle

 
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.10.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.2024-08-22




 
dontdream--BP Profile Search
 
The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bps_ajax_field_selector(), bps_ajax_template_options(), and bps_ajax_field_row() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-20



 
oretnom23 -- simple_forum_website
 
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Forum Website 1.0. This affects an unknown part of the file /registration.php of the component Signup Page. The manipulation of the argument username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-19



 
itsourcecode--Project Expense Monitoring System
 
A vulnerability classified as critical has been found in itsourcecode Project Expense Monitoring System 1.0. This affects an unknown part of the file transferred_report.php. The manipulation of the argument start/end/employee leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
itsourcecode--Project Expense Monitoring System
 
A vulnerability classified as critical was found in itsourcecode Project Expense Monitoring System 1.0. This vulnerability affects unknown code of the file printtransfer.php. The manipulation of the argument transfer_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
itsourcecode--Laravel Property Management System
 
A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file PropertiesController.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
chillzhuang--spring blade
 
A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-21



 
GitLab--GitLab

 
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer.2024-08-22

 
TOTOLINK--AC1200 T8

 
A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-22




 
TOTOLINK--AC1200 T8

 
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-22



 
sourcecodester--online health care system

 
A vulnerability classified as critical has been found in SourceCodester Online Health Care System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument f_name with the input 1%' or 1=1 ) UNION SELECT 1,2,3,4,5,database(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# as part of string leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 
sourcecodester--online computer and laptop store

 
A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /php-ocls/classes/Master.php?f=pay_order. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 
Source Codester--E-Commerce System

 
A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce/popup_Item.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 
Source Codester--E-Commerce System

 
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-23




 
D-Link--DNS120

 
A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link--DNS120

 
A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_add_zip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link-DNS120

 
A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected is the function cgi_s3_modify of the file /cgi-bin/s3.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_job_name leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link--DNS120

 
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this vulnerability is the function cgi_s3 of the file /cgi-bin/s3.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_a_key leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link-DNS120

 
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function module_enable_disable of the file /cgi-bin/apkg_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_module_name leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link--DNS120

 
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function webdav_mgr of the file /cgi-bin/webdav_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link--DNS120

 
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declared as critical. This vulnerability affects the function cgi_FMT_R5_SpareDsk_DiskMGR of the file /cgi-bin/hd_config.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_source_dev leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
D-Link--DNS120
 
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue affects the function cgi_FMT_Std2R5_1st_DiskMGR of the file /cgi-bin/hd_config.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_source_dev leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.2024-08-24





 
Go-Tribe--gotribe

 
A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.2024-08-24





 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: iio: adc: men_z188_adc: Fix a resource leak in an error handling path If iio_device_register() fails, a previous ioremap() is left unbalanced. Update the error handling path and add the missing iounmap() call, as already done in the remove function.2024-08-22







 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to out of bounds access into reg2btf_ids. When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btf_ids as a cheap way to translate the verifier reg type to the appropriate btf_vmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL") moved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.2024-08-22


 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: RDMA/ib_srp: Fix a deadlock Remove the flush_workqueue(system_long_wq) call since flushing system_long_wq is deadlock-prone and since that call is redundant with a preceding cancel_work_sync()2024-08-22







 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70 This patch fixes the issue by both increasing the allocated buffers to accommodate for the needed actions and by checking the number of actions to prevent this issue when a rule with too many actions is provided.2024-08-22

 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memory leak during stateful obj update stateful objects can be updated from the control plane. The transaction logic allocates a temporary object for this purpose. The ->init function was called for this object, so plain kfree() leaks resources. We must call ->destroy function of the object. nft_obj_destroy does this, but it also decrements the module refcount, but the update path doesn't increment it. To avoid special-casing the update object release, do module_get for the update case too and release it via nft_obj_destroy().2024-08-22




 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX) inclusive. So NFP_MAX_MAC_INDEX (0xff) is a valid id. In order for the error handling path to work correctly, the 'invalid' value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range, inclusive. So set it to -1.2024-08-22




 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unregister flowtable hooks on netns exit Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF. BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666 CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106 print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450 kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232 nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nf_flow_table_free() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block.2024-08-22





 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: gso: do not skip outer ip header in case of ipip and net_failover We encounter a tcp drop issue in our cloud environment. Packet GROed in host forwards to a VM virtio_net nic with net_failover enabled. VM acts as a IPVS LB with ipip encapsulation. The full path like: host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat -> ipip encap -> net_failover tx -> virtio_net tx When net_failover transmits a ipip pkt (gso_type = 0x0103, which means SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso did because it supports TSO and GSO_IPXIP4. But network_header points to inner ip header. Call Trace: tcp4_gso_segment ------> return NULL inet_gso_segment ------> inner iph, network_header points to ipip_gso_segment inet_gso_segment ------> outer iph skb_mac_gso_segment Afterwards virtio_net transmits the pkt, only inner ip header is modified. And the outer one just keeps unchanged. The pkt will be dropped in remote host. Call Trace: inet_gso_segment ------> inner iph, outer iph is skipped skb_mac_gso_segment __skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit __qdisc_run __dev_queue_xmit ------> virtio_net dev_hard_start_xmit __dev_queue_xmit ------> net_failover ip_finish_output2 ip_output iptunnel_xmit ip_tunnel_xmit ipip_tunnel_xmit ------> ipip dev_hard_start_xmit __dev_queue_xmit ip_finish_output2 ip_output ip_forward ip_rcv __netif_receive_skb_one_core netif_receive_skb_internal napi_gro_receive receive_buf virtnet_poll net_rx_action The root cause of this issue is specific with the rare combination of SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option. SKB_GSO_DODGY is set from external virtio_net. We need to reset network header when callbacks.gso_segment() returns NULL. This patch also includes ipv6_gso_segment(), considering SIT, etc.2024-08-22







 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.2024-08-22



 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to incorrect copy_map_value When both bpf_spin_lock and bpf_timer are present in a BPF map value, copy_map_value needs to skirt both objects when copying a value into and out of the map. However, the current code does not set both s_off and t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock is placed in map value with bpf_timer, as bpf_map_update_elem call will be able to overwrite the other timer object. When the issue is not fixed, an overwriting can produce the following splat: [root@(none) bpf]# ./test_progs -t timer_crash [ 15.930339] bpf_testmod: loading out-of-tree module taints kernel. [ 16.037849] ================================================================== [ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G OE 5.16.0+ #278 [ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 16.040485] Call Trace: [ 16.040645] <TASK> [ 16.040805] dump_stack_lvl+0x59/0x73 [ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.041427] kasan_report.cold+0x116/0x11b [ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042328] ? memcpy+0x39/0x60 [ 16.042552] ? pv_hash+0xd0/0xd0 [ 16.042785] ? lockdep_hardirqs_off+0x95/0xd0 [ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0 [ 16.043366] ? bpf_get_current_comm+0x50/0x50 [ 16.043608] ? jhash+0x11a/0x270 [ 16.043848] bpf_timer_cancel+0x34/0xe0 [ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81 [ 16.044500] bpf_trampoline_6442477838_0+0x36/0x1000 [ 16.044836] __x64_sys_nanosleep+0x5/0x140 [ 16.045119] do_syscall_64+0x59/0x80 [ 16.045377] ? lock_is_held_type+0xe4/0x140 [ 16.045670] ? irqentry_exit_to_user_mode+0xa/0x40 [ 16.046001] ? mark_held_locks+0x24/0x90 [ 16.046287] ? asm_exc_page_fault+0x1e/0x30 [ 16.046569] ? asm_exc_page_fault+0x8/0x30 [ 16.046851] ? lockdep_hardirqs_on+0x7e/0x100 [ 16.047137] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 16.047405] RIP: 0033:0x7f9e4831718d [ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608] </TASK> [ 16.051762] ==================================================================2024-08-22


 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devm_thermal_zone_of_sensor_register() may return -ENODEV. This may result in crashes similar to the following. Unable to handle kernel NULL pointer dereference at virtual address 00000000000003cd ... Internal error: Oops: 96000021 [#1] PREEMPT SMP ... pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mutex_lock+0x18/0x60 lr : thermal_zone_device_update+0x40/0x2e0 sp : ffff800014c4fc60 x29: ffff800014c4fc60 x28: ffff365ee3f6e000 x27: ffffdde218426790 x26: ffff365ee3f6e000 x25: 0000000000000000 x24: ffff365ee3f6e000 x23: ffffdde218426870 x22: ffff365ee3f6e000 x21: 00000000000003cd x20: ffff365ee8bf3308 x19: ffffffffffffffed x18: 0000000000000000 x17: ffffdde21842689c x16: ffffdde1cb7a0b7c x15: 0000000000000040 x14: ffffdde21a4889a0 x13: 0000000000000228 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000001120000 x7 : 0000000000000001 x6 : 0000000000000000 x5 : 0068000878e20f07 x4 : 0000000000000000 x3 : 00000000000003cd x2 : ffff365ee3f6e000 x1 : 0000000000000000 x0 : 00000000000003cd Call trace: mutex_lock+0x18/0x60 hwmon_notify_event+0xfc/0x110 0xffffdde1cb7a0a90 0xffffdde1cb7a0b7c irq_thread_fn+0x2c/0xa0 irq_thread+0x134/0x240 kthread+0x178/0x190 ret_from_fork+0x10/0x20 Code: d503201f d503201f d2800001 aa0103e4 (c8e47c02) Jon Hunter reports that the exact call sequence is: hwmon_notify_event() --> hwmon_thermal_notify() --> thermal_zone_device_update() --> update_temperature() --> mutex_lock() The hwmon core needs to handle all errors returned from calls to devm_thermal_zone_of_sensor_register(). If the call fails with -ENODEV, report that the sensor was not attached to a thermal zone but continue to register the hwmon device.2024-08-22



 
Open-Xchange GmbH--OX App Suite
 
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social engineering to make a user follow a prepared link to a malicious account. Please deploy the provided updates and patch releases. The savepoint module path has been restricted to modules that provide the feature, excluding any arbitrary or non-existing modules. No publicly available exploits are known.2024-08-19

 
google -- nest_mini_firmware
 
The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through.2024-08-19
 
n/a--n/a
 
Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.2024-08-19

 
N/A -- N/A

 
Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device.2024-08-22

 
friendica -- friendica
 
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.2024-08-20


 
ibm -- sterling_connect_direct_web_services
 
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.2024-08-22

 
okfn -- ckan
 
CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.2024-08-21

 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager
 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager
 
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.2024-08-23
 
7-twenty -- bot
 
7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2024-08-20
 
matrix -- javascript_sdk
 
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.2024-08-20

 
mattermost -- mattermost
 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.2024-08-22
 
N/A -- N/A

 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields.2024-08-22

 
N/A -- N/A

 
A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter.2024-08-22

 
N/A -- N/A

 
Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter.2024-08-21

 

 

icegram--Icegram
 

Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a through 3.1.24.2024-08-19
 
VOID CODERS--Void Elementor Post Grid Addon for Elementor Page builder
 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows PHP Local File Inclusion.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.3.2024-08-19
 
Jamie Bergen--Plugin Notes Plus
 
Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.2024-08-19
 
VeronaLabs--WPSMS

 
Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.2024-08-22
 
umbraco--Umbraco-CMS
 
Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.2024-08-20

 
khoj-ai--khoj

 
Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.2024-08-20


 
ruby--rexml

 
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.2024-08-22

 
xwiki -- xwiki
 
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0.2024-08-19


 
honojs--hono

 
Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.2024-08-22


 
webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform
 
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.2024-08-20


 
webdevmattcrom--GiveWP Donation Plugin and Fundraising Platform
 
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.2024-08-20


 
3ds -- 3dexperience
 
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.2024-08-20
 
maxfoundry--word press button plugin maxbuttons

 
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.2024-08-24


 
GitLab--GitLab

 
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.2024-08-22

 
flamix--Flamix: Bitrix24 and Contact Form 7 integrations

 
The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.2024-08-21


 

 imagerecycle--ImageRecycle pdf & image compression
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.2024-08-24

 
sersis--wordsurvey

 
The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sounding_title' parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-08-21


 
starkinfo--WP testimonial widget
 
The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function in all versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to change the order of testimonials.2024-08-21

 
appcheap--App Builder – Create Native Android & iOS Apps On The Flight

 
The App Builder - Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the 'app-builder-search' parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-08-21

 
bitpressadmin--Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
 
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.2024-08-20

 
adonesevangelista -- laravel_property_management_system
 
A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/notes/create of the component Notes Page. The manipulation of the argument Note text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
rems -- account_manager_app
 
A vulnerability classified as problematic was found in SourceCodester Accounts Manager App 1.0. This vulnerability affects unknown code of the file update-account.php of the component Update Account Page. The manipulation of the argument Account Name/Username/Password/Link leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
N/A -- N/A

 
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users2024-08-22
 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C --------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex.2024-08-22







 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: ice: fix concurrent reset and removal of VFs Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is intended to prevent some issues with concurrently handling messages from VFs while tearing down the VFs. This change was motivated by crashes caused while tearing down and bringing up VFs in rapid succession. It turns out that the fix actually introduces issues with the VF driver caused because the PF no longer responds to any messages sent by the VF during its .remove routine. This results in the VF potentially removing its DMA memory before the PF has shut down the device queues. Additionally, the fix doesn't actually resolve concurrency issues within the ice driver. It is possible for a VF to initiate a reset just prior to the ice driver removing VFs. This can result in the remove task concurrently operating while the VF is being reset. This results in similar memory corruption and panics purportedly fixed by that commit. Fix this concurrency at its root by protecting both the reset and removal flows using the existing VF cfg_lock. This ensures that we cannot remove the VF while any outstanding critical tasks such as a virtchnl message or a reset are occurring. This locking change also fixes the root cause originally fixed by commit c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we can simply revert it. Note that I kept these two changes together because simply reverting the original commit alone would leave the driver vulnerable to worse race conditions.2024-08-22



 
sasiddiqui--Custom Permalinks

 
The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.2024-08-24




 
GitLab--GitLab

 
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.2024-08-22

 
N/A -- WP Table Builder

 
The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-08-23
 
Spring--Spring Framework
 
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.2024-08-20
 
ibm -- sterling_connect_direct_web_services
 
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.2024-08-22

 
mattermost -- mattermost
 
Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash.2024-08-22
 
Priority--Priority
 
Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor2024-08-20
 
Priority--Priority
 
Priority - CWE-552: Files or Directories Accessible to External Parties2024-08-20
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.2024-08-23
 
Adobe--Adobe Experience Manager

 
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. An low-privileged attacker could leverage this vulnerability to slightly affect the integrity of the page. Exploitation of this issue requires user interaction and scope is changed.2024-08-23
 
N/A -- N/A

 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter.2024-08-22

 
N/A -- N/A

 
A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter.2024-08-22

 
N/A -- N/A

 
A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field.2024-08-21
 
N/A -- N/A

 
autMan v2.9.6 was discovered to contain an access control issue.2024-08-23

 
N/A -- N/A

 
autMan v2.9.6 allows attackers to bypass authentication via a crafted web request.2024-08-23
 
mattermost-mattermost

 
Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.2024-08-23
 
Scott Paterson--Easy PayPal Buy Now Button
 
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.2024-08-19
 
Salon Booking System--Salon booking system
 
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.2024-08-19
 
Metagauss User Registration Team--RegistrationMagic
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic allows Cross-Site Scripting (XSS).This issue affects RegistrationMagic: from n/a through 6.0.1.0.2024-08-19
 
umbraco--Umbraco-CMS
 
Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.2024-08-20

 
apolloconfig--apollo
 
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.2024-08-20



 
Mattermost--Mattermost

 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.2024-08-22
 
vim--vim
 
Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.2024-08-22

 
mattermost -- mattermost
 
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.2024-08-22
 
clevelandwebdeveloper--hide my site

 
The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricting access to the REST API when password protection is enabled. This makes it possible for unauthenticated attackers to gain unauthorized access to the site.2024-08-21

 
Grafana-Grafana

 
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.2024-08-20
 
sethshoultes--Event Espresso – Event Registration & Ticketing Sales

 
The Event Espresso 4 Decaf - Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to, and including, 5.0.22.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.2024-08-21

 
elbanyaoui--Smart Online Order for Clover

 
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update product and category descriptions, category titles and images, and sort order.2024-08-21


 
F5--NGINX Agents

 
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.2024-08-22
 
themifyme--Themify Builder

 
The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.2024-08-22

 
deepakkite--User Private Files – WordPress File Sharing Plugin

 
The User Private Files - WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to gain access to other user's private files.2024-08-22

 
n/a--FastAdmin
 
A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.2024-08-19



 
google -- chrome
 
Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)2024-08-21

 
google -- chrome
 
Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)2024-08-21

 
google -- chrome
 
Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)2024-08-21

 
google -- chrome
 
Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)2024-08-21

 
Google--Chrome

 
Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)2024-08-21

 
google -- chrome
 
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)2024-08-21

 
google -- chrome
 
Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)2024-08-21

 
Thinkgem--JeeSite
 
A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the component Cookie Handler. The manipulation of the argument skinName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-23


 
ImageRecycle--ImageRecycle pdf & image compression

 
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-08-24

 

Low Vulnerabilities

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource InfoPatch Info
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: io_uring: add a schedule point in io_add_buffers() Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN). [ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575] [ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O) [ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801 [ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98) [ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 [ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 [ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001 [ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a [ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004 [ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380 [ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0 [ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000 [ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0 [ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 253.544494] Call Trace: [ 253.544496] <TASK> [ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544505] __kernel_text_address (kernel/extable.c:78) [ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19) [ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27) [ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544521] stack_trace_save (kernel/stacktrace.c:123) [ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?) [ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546) [ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078) [ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441) [ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) [ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?) [ 253.544596] __io_queue_sqe (fs/io_uring.c:?) [ 253.544600] io_queue_sqe (fs/io_uring.c:7143) [ 253.544603] io_submit_sqe (fs/io_uring.c:?) [ 253.544608] io_submit_sqes (fs/io_uring.c:?) [ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uri ---truncated---2024-08-22



 
linux -- linux_kernel
 
In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcu_barrier Nothing prevents batch ops to process huge amount of data, we need to add schedule points in them. Note that maybe_wait_bpf_programs(map) calls from generic_map_delete_batch() can be factorized by moving the call after the loop. This will be done later in -next tree once we get this fix merged, unless there is strong opinion doing this optimization sooner.2024-08-22



 
mattermost -- mattermost
 
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."2024-08-22
 
trufflesecurity -- trufflehog
 
TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. The vulnerability has been resolved in TruffleHog v3.81.9 and later versions.2024-08-19

 
ckeditor--ckeditor4

 
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.2024-08-21

 
SourceCodester--Leads Manager Tool
 
A vulnerability has been found in SourceCodester Leads Manager Tool 1.0 and classified as problematic. This vulnerability affects unknown code of the file update-leads.php. The manipulation of the argument phone_number leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-20



 
Genexis--Tilgin Home Gateway

 
A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing of the file /vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=86213915328111654515&user=A&message2user=Account%20updated. The manipulation of the argument Phone Number leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-08-21


 
SourceCodester--Record Management System

 
A vulnerability, which was classified as problematic, was found in SourceCodester Record Management System 1.0. This affects an unknown part of the file sort1_user.php. The manipulation of the argument position leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-24




 
SourceCodester--Record Management System

 
A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file search_user.php. The manipulation of the argument search leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2024-08-24




 
mattermost--mattermost

 
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.2024-08-22
 
Byron--gitoxide
 
gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters-including those that form ANSI escape sequences-that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.2024-08-22
 
Octopuc Deploy--Octopus Server

 
In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.2024-08-21
 
SourceCodester--Online Computer and Laptop Store

 
A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /php-ocls/classes/SystemSettings.php?f=update_settings of the component Setting Handler. The manipulation of the argument System Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.2024-08-22




 

Severity Not Yet Assigned

Primary
Vendor -- Product
DescriptionPublishedCVSS ScoreSource InfoPatch Info
N/A -- N/A

 
Python Pip Pandas v2.2.2 was discovered to contain an arbitrary file read vulnerability.2024-08-23not yet calculated

 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(), which could lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of tmpbuf. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings, and our static analyzer no longer warns about this code.2024-08-22not yet calculated




 
OpenText--Performance Center
 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This issue affects Performance Center: 12.63.2024-08-21not yet calculated
 
OpenText--Performance Center
 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText Performance Center on Windows allows Cross-Site Scripting (XSS).This issue affects Performance Center: 12.63.2024-08-21not yet calculated
 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Prevent use after free on completion memory On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling. Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove. Some examples of problematic flows: (a) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully. idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq(). (b) idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0. idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref: BUG: kernel NULL pointer dereference, address: 0000000000000010 Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully.2024-08-21not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: USB: gadgetfs: Fix race between mounting and unmounting The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part: BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline] The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex.2024-08-21not yet calculated




 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: tty: fix possible null-ptr-defer in spk_ttyio_release Run the following tests on the qemu platform: syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow: syzkaller:~# modprobe -r speakup_audptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutex_lock+0x14/0x30 Call Trace: <TASK> spk_ttyio_release+0x19/0x70 [speakup] synth_release.part.6+0xac/0xc0 [speakup] synth_remove+0x56/0x60 [speakup] __x64_sys_delete_module+0x156/0x250 ? fpregs_assert_state_consistent+0x1d/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer: in_synth->dev was not initialized during modprobe, so we add check for in_synth->dev to fix this bug.2024-08-21not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer.2024-08-21not yet calculated



 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall2024-08-21not yet calculated




 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on creater_process and device_release Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead. The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0.2024-08-21not yet calculated




 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free and race in fastrpc_map_find Currently, there is a race window between the point when the mutex is unlocked in fastrpc_map_lookup and the reference count increasing (fastrpc_map_get) in fastrpc_map_find, which can also lead to use-after-free. So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us to both protect the maps list by also taking the &fl->lock spinlock and the reference count, since the spinlock will be released only after. Add take_ref argument to make this suitable for all callers.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 might_sleep(); 394 395 sdata = get_bss_sdata(sdata); 396 if (!check_sdata_in_driver(sdata)) 397 return -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: moving STA 02:00:00:00:03:00 to state 3 wlan0: associated wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) wlan0: moving STA 02:00:00:00:03:00 to state 2 wlan0: moving STA 02:00:00:00:03:00 to state 1 wlan0: Removed STA 02:00:00:00:03:00 wlan0: Destroyed STA 02:00:00:00:03:00 BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace: <TASK> ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] process_one_work+0x29f/0x620 worker_thread+0x4d/0x3d0 ? process_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>2024-08-21not yet calculated



 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix initialization of rx->link and rx->link_sta There are some codepaths that do not initialize rx->link_sta properly. This causes a crash in places which assume that rx->link_sta is valid if rx->sta is valid. One known instance is triggered by __ieee80211_rx_h_amsdu being called from fast-rx. It results in a crash like this one: BUG: kernel NULL pointer dereference, address: 00000000000000a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3 Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014 RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211] Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48 83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0 11 00 00 8d 50 fd 83 fa 01 RSP: 0018:ffff999040803b10 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900 R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000 FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0 Call Trace: <TASK> __ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211] ? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ? __local_bh_enable_ip+0x3b/0xa0 ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ? prepare_transfer+0x109/0x1a0 [xhci_hcd] ieee80211_rx_list+0xa80/0xda0 [mac80211] mt76_rx_complete+0x207/0x2e0 [mt76] mt76_rx_poll_complete+0x357/0x5a0 [mt76] mt76u_rx_worker+0x4f5/0x600 [mt76_usb] ? mt76_get_min_avg_rssi+0x140/0x140 [mt76] __mt76_worker_fn+0x50/0x80 [mt76] kthread+0xed/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Since the initialization of rx->link and rx->link_sta is rather convoluted and duplicated in many places, clean it up by using a helper function to set it. [remove unnecessary rx->sta->sta.mlo check]2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: f2fs: let's avoid panic if extent_tree is not created This patch avoids the below panic. pc : __lookup_extent_tree+0xd8/0x760 lr : f2fs_do_write_data_page+0x104/0x87c sp : ffffffc010cbb3c0 x29: ffffffc010cbb3e0 x28: 0000000000000000 x27: ffffff8803e7f020 x26: ffffff8803e7ed40 x25: ffffff8803e7f020 x24: ffffffc010cbb460 x23: ffffffc010cbb480 x22: 0000000000000000 x21: 0000000000000000 x20: ffffffff22e90900 x19: 0000000000000000 x18: ffffffc010c5d080 x17: 0000000000000000 x16: 0000000000000020 x15: ffffffdb1acdbb88 x14: ffffff888759e2b0 x13: 0000000000000000 x12: ffffff802da49000 x11: 000000000a001200 x10: ffffff8803e7ed40 x9 : ffffff8023195800 x8 : ffffff802da49078 x7 : 0000000000000001 x6 : 0000000000000000 x5 : 0000000000000006 x4 : ffffffc010cbba28 x3 : 0000000000000000 x2 : ffffffc010cbb480 x1 : 0000000000000000 x0 : ffffff8803e7ed40 Call trace: __lookup_extent_tree+0xd8/0x760 f2fs_do_write_data_page+0x104/0x87c f2fs_write_single_data_page+0x420/0xb60 f2fs_write_cache_pages+0x418/0xb1c __f2fs_write_data_pages+0x428/0x58c f2fs_write_data_pages+0x30/0x40 do_writepages+0x88/0x190 __writeback_single_inode+0x48/0x448 writeback_sb_inodes+0x468/0x9e8 __writeback_inodes_wb+0xb8/0x2a4 wb_writeback+0x33c/0x740 wb_do_writeback+0x2b4/0x400 wb_workfn+0xe4/0x34c process_one_work+0x24c/0x5bc worker_thread+0x3e8/0xa50 kthread+0x150/0x1b42024-08-21not yet calculated






 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Fix driver shutdown on closed serdev The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also skip this step if device is powered off (qca_power_shutdown()). The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth: Unable to handle kernel paging request at virtual address 0072662f67726fd7 ... CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: tty_driver_flush_buffer+0x4/0x30 serdev_device_write_flush+0x24/0x34 qca_serdev_shutdown+0x80/0x130 [hci_uart] device_shutdown+0x15c/0x260 kernel_restart+0x48/0xac KASAN report: BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50 Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1 CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xdc/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x68/0x84 print_report+0x188/0x488 kasan_report+0xa4/0xf0 __asan_load8+0x80/0xac tty_driver_flush_buffer+0x1c/0x50 ttyport_write_flush+0x34/0x44 serdev_device_write_flush+0x48/0x60 qca_serdev_shutdown+0x124/0x274 device_shutdown+0x1e8/0x350 kernel_restart+0x48/0xb0 __do_sys_reboot+0x244/0x2d0 __arm64_sys_reboot+0x54/0x70 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x44/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xbc/0x140 el0t_64_sync+0x190/0x1942024-08-21not yet calculated



 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer.2024-08-21not yet calculated





 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: platform/surface: aggregator: Add missing call to ssam_request_sync_free() Although rare, ssam_request_sync_init() can fail. In that case, the request should be freed via ssam_request_sync_free(). Currently it is leaked instead. Fix this.2024-08-21not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: Fix refcount leak in amd_pmc_probe pci_get_domain_bus_and_slot() takes reference, the caller should release the reference by calling pci_dev_put() after use. Call pci_dev_put() in the error path to fix this.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY) Upon updating MAC security entity (SecY) in hw offload path, the macsec security association (SA) initialization routine is called. In case of extended packet number (epn) is enabled the salt and ssci attributes are retrieved using the MACsec driver rx_sa context which is unavailable when updating a SecY property such as encoding-sa hence the null dereference. Fix by using the provided SA to set those attributes.2024-08-21not yet calculated

 
Linux--Linux
 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work for child PKEY interfaces because the child interface uses the parent receive channels. Although the child shares the parent's receive channels, the number of rx queues is important for the channel_stats array: the parent's rx channel index is used to access the child's channel_stats. So the array has to be at least as large as the parent's rx queue size for the counting to work correctly and to prevent out of bound accesses. This patch checks for the mentioned scenario and returns an error when trying to create the interface. The error is propagated to the user.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command stats access after free Command may fail while driver is reloading and can't accept FW commands till command interface is reinitialized. Such command failure is being logged to command stats. This results in NULL pointer access as command stats structure is being freed and reallocated during mlx5 devlink reload (see kernel log below). Fix it by making command stats statically allocated on driver probe. Kernel log: [ 2394.808802] BUG: unable to handle kernel paging request at 000000000002a9c0 [ 2394.810610] PGD 0 P4D 0 [ 2394.811811] Oops: 0002 [#1] SMP NOPTI ... [ 2394.815482] RIP: 0010:native_queued_spin_lock_slowpath+0x183/0x1d0 ... [ 2394.829505] Call Trace: [ 2394.830667] _raw_spin_lock_irq+0x23/0x26 [ 2394.831858] cmd_status_err+0x55/0x110 [mlx5_core] [ 2394.833020] mlx5_access_reg+0xe7/0x150 [mlx5_core] [ 2394.834175] mlx5_query_port_ptys+0x78/0xa0 [mlx5_core] [ 2394.835337] mlx5e_ethtool_get_link_ksettings+0x74/0x590 [mlx5_core] [ 2394.836454] ? kmem_cache_alloc_trace+0x140/0x1c0 [ 2394.837562] __rh_call_get_link_ksettings+0x33/0x100 [ 2394.838663] ? __rtnl_unlock+0x25/0x50 [ 2394.839755] __ethtool_get_link_ksettings+0x72/0x150 [ 2394.840862] duplex_show+0x6e/0xc0 [ 2394.841963] dev_attr_show+0x1c/0x40 [ 2394.843048] sysfs_kf_seq_show+0x9b/0x100 [ 2394.844123] seq_read+0x153/0x410 [ 2394.845187] vfs_read+0x91/0x140 [ 2394.846226] ksys_read+0x4f/0xb0 [ 2394.847234] do_syscall_64+0x5b/0x1a0 [ 2394.848228] entry_SYSCALL_64_after_hwframe+0x65/0xca2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: ice: Fix potential memory leak in ice_gnss_tty_write() The ice_gnss_tty_write() return directly if the write_buf alloc failed, leaking the cmd_buf. Fix by free cmd_buf if write_buf alloc failed.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: ice: Add check for kzalloc Add the check for the return value of kzalloc in order to avoid NULL pointer dereference. Moreover, use the goto-label to share the clean code.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_path of_icc_get() alloc resources for path1, we should release it when not need anymore. Early return when IS_ERR_OR_NULL(path0) may leak path1. Defer getting path1 to fix this. Patchwork: https://patchwork.freedesktop.org/patch/514264/2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof-nau8825: fix module alias overflow The maximum name length for a platform_device_id entry is 20 characters including the trailing NUL byte. The sof_nau8825.c file exceeds that, which causes an obscure error message: sound/soc/intel/boards/snd-soc-sof_nau8825.mod.c:35:45: error: illegal character encoding in string literal [-Werror,-Winvalid-source-encoding] MODULE_ALIAS("platform:adl_max98373_nau8825<U+0018><AA>"); ^~~~ include/linux/module.h:168:49: note: expanded from macro 'MODULE_ALIAS' ^~~~~~ include/linux/module.h:165:56: note: expanded from macro 'MODULE_INFO' ^~~~ include/linux/moduleparam.h:26:47: note: expanded from macro '__MODULE_INFO' = __MODULE_INFO_PREFIX __stringify(tag) "=" info I could not figure out how to make the module handling robust enough to handle this better, but as a quick fix, using slightly shorter names that are still unique avoids the build issue.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force. Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: regulator: da9211: Use irq handler when ready If the system does not come from reset (like when it is kexec()), the regulator might have an IRQ waiting for us. If we enable the IRQ handler before its structures are ready, we crash. This patch fixes: [ 1.141839] Unable to handle kernel read from unreadable memory at virtual address 0000000000000078 [ 1.316096] Call trace: [ 1.316101] blocking_notifier_call_chain+0x20/0xa8 [ 1.322757] cpu cpu0: dummy supplies not allowed for exclusive requests [ 1.327823] regulator_notifier_call_chain+0x1c/0x2c [ 1.327825] da9211_irq_handler+0x68/0xf8 [ 1.327829] irq_thread+0x11c/0x234 [ 1.327833] kthread+0x13c/0x1542024-08-21not yet calculated






 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: sched/core: Fix use-after-free bug in dup_user_cpus_ptr() Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the setting and clearing of user_cpus_ptr are done under pi_lock for arm64 architecture. However, dup_user_cpus_ptr() accesses user_cpus_ptr without any lock protection. Since sched_setaffinity() can be invoked from another process, the process being modified may be undergoing fork() at the same time. When racing with the clearing of user_cpus_ptr in __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and possibly double-free in arm64 kernel. Commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") fixes this problem as user_cpus_ptr, once set, will never be cleared in a task's lifetime. However, this bug was re-introduced in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in do_set_cpus_allowed(). This time, it will affect all arches. Fix this bug by always clearing the user_cpus_ptr of the newly cloned/forked task before the copying process starts and check the user_cpus_ptr state of the source task under pi_lock. Note to stable, this patch won't be applicable to stable releases. Just copy the new dup_user_cpus_ptr() function over.2024-08-21not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Cleanup partial engine discovery failures If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz)2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Don't unregister on shutdown Similar to SMMUv2, this driver calls iommu_device_unregister() from the shutdown path, which removes the IOMMU groups with no coordination whatsoever with their users - shutdown methods are optional in device drivers. This can lead to NULL pointer dereferences in those drivers' DMA API calls, or worse. Instead of calling the full arm_smmu_device_remove() from arm_smmu_device_shutdown(), let's pick only the relevant function call - arm_smmu_device_disable() - more or less the reverse of arm_smmu_device_reset() - and call just that from the shutdown path.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Don't unregister on shutdown Michael Walle says he noticed the following stack trace while performing a shutdown with "reboot -f". He suggests he got "lucky" and just hit the correct spot for the reboot while there was a packet transmission in flight. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 6.1.0-rc5-00088-gf3600ff8e322 #1930 Hardware name: Kontron KBox A-230-LS (DT) pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_map_page+0x9c/0x254 Call trace: iommu_get_dma_domain+0x14/0x20 dma_map_page_attrs+0x1ec/0x250 enetc_start_xmit+0x14c/0x10b0 enetc_xmit+0x60/0xdc dev_hard_start_xmit+0xb8/0x210 sch_direct_xmit+0x11c/0x420 __dev_queue_xmit+0x354/0xb20 ip6_finish_output2+0x280/0x5b0 __ip6_finish_output+0x15c/0x270 ip6_output+0x78/0x15c NF_HOOK.constprop.0+0x50/0xd0 mld_sendpack+0x1bc/0x320 mld_ifc_work+0x1d8/0x4dc process_one_work+0x1e8/0x460 worker_thread+0x178/0x534 kthread+0xe0/0xe4 ret_from_fork+0x10/0x20 Code: d503201f f9416800 d503233f d50323bf (f9404c00) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt This appears to be reproducible when the board has a fixed IP address, is ping flooded from another host, and "reboot -f" is used. The following is one more manifestation of the issue: $ reboot -f kvm: exiting hardware virtualization cfg80211: failed to load regulatory.db arm-smmu 5000000.iommu: disabling translation sdhci-esdhc 2140000.mmc: Removing from iommu group 11 sdhci-esdhc 2150000.mmc: Removing from iommu group 12 fsl-edma 22c0000.dma-controller: Removing from iommu group 17 dwc3 3100000.usb: Removing from iommu group 9 dwc3 3110000.usb: Removing from iommu group 10 ahci-qoriq 3200000.sata: Removing from iommu group 2 fsl-qdma 8380000.dma-controller: Removing from iommu group 20 platform f080000.display: Removing from iommu group 0 etnaviv-gpu f0c0000.gpu: Removing from iommu group 1 etnaviv etnaviv: Removing from iommu group 1 caam_jr 8010000.jr: Removing from iommu group 13 caam_jr 8020000.jr: Removing from iommu group 14 caam_jr 8030000.jr: Removing from iommu group 15 caam_jr 8040000.jr: Removing from iommu group 16 fsl_enetc 0000:00:00.0: Removing from iommu group 4 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.1: Removing from iommu group 5 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00:00.2: Removing from iommu group 6 fsl_enetc_mdio 0000:00:00.3: Removing from iommu group 8 mscc_felix 0000:00:00.5: Removing from iommu group 3 fsl_enetc 0000:00:00.6: Removing from iommu group 7 pcieport 0001:00:00.0: Removing from iommu group 18 arm-smmu 5000000.iommu: Blocked unknown Stream ID 0x429; boot with "arm-smmu.disable_bypass=0" to allow, but this may have security implications arm-smmu 5000000.iommu: GFSR 0x00000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 pcieport 0002:00:00.0: Removing from iommu group 19 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 pc : iommu_get_dma_domain+0x14/0x20 lr : iommu_dma_unmap_page+0x38/0xe0 Call trace: iommu_get_dma_domain+0x14/0x20 dma_unmap_page_attrs+0x38/0x1d0 en ---truncated---2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix pci device refcount leak As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak.2024-08-21not yet calculated




 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect file_map_count for invalid pmd The page table check trigger BUG_ON() unexpectedly when split hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:119! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 7 PID: 210 Comm: transhuge-stres Not tainted 6.1.0-rc3+ #748 Hardware name: linux,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_set.isra.0+0x398/0x468 lr : page_table_check_set.isra.0+0x1c0/0x468 [...] Call trace: page_table_check_set.isra.0+0x398/0x468 __page_table_check_pte_set+0x160/0x1c0 __split_huge_pmd_locked+0x900/0x1648 __split_huge_pmd+0x28c/0x3b8 unmap_page_range+0x428/0x858 unmap_single_vma+0xf4/0x1c8 zap_page_range+0x2b0/0x410 madvise_vma_behavior+0xc44/0xe78 do_madvise+0x280/0x698 __arm64_sys_madvise+0x90/0xe8 invoke_syscall.constprop.0+0xdc/0x1d8 do_el0_svc+0xf4/0x3f8 el0_svc+0x58/0x120 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x19c/0x1a0 [...] On arm64, pmd_leaf() will return true even if the pmd is invalid due to pmd_present_invalid() check. So in pmdp_invalidate() the file_map_count will not only decrease once but also increase once. Then in set_pte_at(), the file_map_count increase again, and so trigger BUG_ON() unexpectedly. Add !pmd_present_invalid() check in pmd_user_accessible_page() to fix the problem.2024-08-21not yet calculated

 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer There are 3 possible interrupt sources are handled by DP controller, HPDstatus, Controller state changes and Aux read/write transaction. At every irq, DP controller have to check isr status of every interrupt sources and service the interrupt if its isr status bits shows interrupts are pending. There is potential race condition may happen at current aux isr handler implementation since it is always complete dp_aux_cmd_fifo_tx() even irq is not for aux read or write transaction. This may cause aux read transaction return premature if host aux data read is in the middle of waiting for sink to complete transferring data to host while irq happen. This will cause host's receiving buffer contains unexpected data. This patch fixes this problem by checking aux isr and return immediately at aux isr handler if there are no any isr status bits set. Current there is a bug report regrading eDP edid corruption happen during system booting up. After lengthy debugging to found that VIDEO_READY interrupt was continuously firing during system booting up which cause dp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data from aux hardware buffer which is not yet contains complete data transfer from sink. This cause edid corruption. Follows are the signature at kernel logs when problem happen, EDID has corrupt header panel-simple-dp-aux aux-aea0000.edp: Couldn't identify panel via EDID Changes in v2: -- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr() -- add more commit text Changes in v3: -- add Stephen suggested -- dp_aux_isr() return IRQ_XXX back to caller -- dp_ctrl_isr() return IRQ_XXX back to caller Changes in v4: -- split into two patches Changes in v5: -- delete empty line between tags Changes in v6: -- remove extra "that" and fixed line more than 75 char at commit text Patchwork: https://patchwork.freedesktop.org/patch/516121/2024-08-21not yet calculated



 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object.2024-08-21not yet calculated





 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not start relocation until in progress drops are done We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by injecting errors into snapshot delete with balance running at the same time. This presented as an error while looking up an extent item WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680 CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8 RIP: 0010:lookup_inline_extent_backref+0x647/0x680 RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000 RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001 R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000 R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000 FS: 0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0 Call Trace: <TASK> insert_inline_extent_backref+0x46/0xd0 __btrfs_inc_extent_ref.isra.0+0x5f/0x200 ? btrfs_merge_delayed_refs+0x164/0x190 __btrfs_run_delayed_refs+0x561/0xfa0 ? btrfs_search_slot+0x7b4/0xb30 ? btrfs_update_root+0x1a9/0x2c0 btrfs_run_delayed_refs+0x73/0x1f0 ? btrfs_update_root+0x1a9/0x2c0 btrfs_commit_transaction+0x50/0xa50 ? btrfs_update_reloc_root+0x122/0x220 prepare_to_merge+0x29f/0x320 relocate_block_group+0x2b8/0x550 btrfs_relocate_block_group+0x1a6/0x350 btrfs_relocate_chunk+0x27/0xe0 btrfs_balance+0x777/0xe60 balance_kthread+0x35/0x50 ? btrfs_balance+0xe60/0xe60 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Normally snapshot deletion and relocation are excluded from running at the same time by the fs_info->cleaner_mutex. However if we had a pending balance waiting to get the ->cleaner_mutex, and a snapshot deletion was running, and then the box crashed, we would come up in a state where we have a half deleted snapshot. Again, in the normal case the snapshot deletion needs to complete before relocation can start, but in this case relocation could very well start before the snapshot deletion completes, as we simply add the root to the dead roots list and wait for the next time the cleaner runs to clean up the snapshot. Fix this by setting a bit on the fs_info if we have any DEAD_ROOT's that had a pending drop_progress key. If they do then we know we were in the middle of the drop operation and set a flag on the fs_info. Then balance can wait until this flag is cleared to start up again. If there are DEAD_ROOT's that don't have a drop_progress set then we're safe to start balance right away as we'll be properly protected by the cleaner_mutex.2024-08-22not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not WARN_ON() if we have PageError set Whenever we do any extent buffer operations we call assert_eb_page_uptodate() to complain loudly if we're operating on an non-uptodate page. Our overnight tests caught this warning earlier this week WARNING: CPU: 1 PID: 553508 at fs/btrfs/extent_io.c:6849 assert_eb_page_uptodate+0x3f/0x50 CPU: 1 PID: 553508 Comm: kworker/u4:13 Tainted: G W 5.17.0-rc3+ #564 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Workqueue: btrfs-cache btrfs_work_helper RIP: 0010:assert_eb_page_uptodate+0x3f/0x50 RSP: 0018:ffffa961440a7c68 EFLAGS: 00010246 RAX: 0017ffffc0002112 RBX: ffffe6e74453f9c0 RCX: 0000000000001000 RDX: ffffe6e74467c887 RSI: ffffe6e74453f9c0 RDI: ffff8d4c5efc2fc0 RBP: 0000000000000d56 R08: ffff8d4d4a224000 R09: 0000000000000000 R10: 00015817fa9d1ef0 R11: 000000000000000c R12: 00000000000007b1 R13: ffff8d4c5efc2fc0 R14: 0000000001500000 R15: 0000000001cb1000 FS: 0000000000000000(0000) GS:ffff8d4dbbd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff31d3448d8 CR3: 0000000118be8004 CR4: 0000000000370ee0 Call Trace: extent_buffer_test_bit+0x3f/0x70 free_space_test_bit+0xa6/0xc0 load_free_space_tree+0x1f6/0x470 caching_thread+0x454/0x630 ? rcu_read_lock_sched_held+0x12/0x60 ? rcu_read_lock_sched_held+0x12/0x60 ? rcu_read_lock_sched_held+0x12/0x60 ? lock_release+0x1f0/0x2d0 btrfs_work_helper+0xf2/0x3e0 ? lock_release+0x1f0/0x2d0 ? finish_task_switch.isra.0+0xf9/0x3a0 process_one_work+0x26d/0x580 ? process_one_work+0x580/0x580 worker_thread+0x55/0x3b0 ? process_one_work+0x580/0x580 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 This was partially fixed by c2e39305299f01 ("btrfs: clear extent buffer uptodate when we fail to write it"), however all that fix did was keep us from finding extent buffers after a failed writeout. It didn't keep us from continuing to use a buffer that we already had found. In this case we're searching the commit root to cache the block group, so we can start committing the transaction and switch the commit root and then start writing. After the switch we can look up an extent buffer that hasn't been written yet and start processing that block group. Then we fail to write that block out and clear Uptodate on the page, and then we start spewing these errors. Normally we're protected by the tree lock to a certain degree here. If we read a block we have that block read locked, and we block the writer from locking the block before we submit it for the write. However this isn't necessarily fool proof because the read could happen before we do the submit_bio and after we locked and unlocked the extent buffer. Also in this particular case we have path->skip_locking set, so that won't save us here. We'll simply get a block that was valid when we read it, but became invalid while we were using it. What we really want is to catch the case where we've "read" a block but it's not marked Uptodate. On read we ClearPageError(), so if we're !Uptodate and !Error we know we didn't do the right thing for reading the page. Fix this by checking !Uptodate && !Error, this way we will not complain if our buffer gets invalidated while we're using it, and we'll maintain the spirit of the check which is to make sure we have a fully in-cache block while we're messing with it.2024-08-22not yet calculated


 
Linux--Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix relocation crash due to premature return from btrfs_commit_transaction() We are seeing crashes similar to the following trace: [38.969182] WARNING: CPU: 20 PID: 2105 at fs/btrfs/relocation.c:4070 btrfs_relocate_block_group+0x2dc/0x340 [btrfs] [38.973556] CPU: 20 PID: 2105 Comm: btrfs Not tainted 5.17.0-rc4 #54 [38.974580] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [38.976539] RIP: 0010:btrfs_relocate_block_group+0x2dc/0x340 [btrfs] [38.980336] RSP: 0000:ffffb0dd42e03c20 EFLAGS: 00010206 [38.981218] RAX: ffff96cfc4ede800 RBX: ffff96cfc3ce0000 RCX: 000000000002ca14 [38.982560] RDX: 0000000000000000 RSI: 4cfd109a0bcb5d7f RDI: ffff96cfc3ce0360 [38.983619] RBP: ffff96cfc309c000 R08: 0000000000000000 R09: 0000000000000000 [38.984678] R10: ffff96cec0000001 R11: ffffe84c80000000 R12: ffff96cfc4ede800 [38.985735] R13: 0000000000000000 R14: 0000000000000000 R15: ffff96cfc3ce0360 [38.987146] FS: 00007f11c15218c0(0000) GS:ffff96d6dfb00000(0000) knlGS:0000000000000000 [38.988662] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [38.989398] CR2: 00007ffc922c8e60 CR3: 00000001147a6001 CR4: 0000000000370ee0 [38.990279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [38.991219] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [38.992528] Call Trace: [38.992854] <TASK> [38.993148] btrfs_relocate_chunk+0x27/0xe0 [btrfs] [38.993941] btrfs_balance+0x78e/0xea0 [btrfs] [38.994801] ? vsnprintf+0x33c/0x520 [38.995368] ? __kmalloc_track_caller+0x351/0x440 [38.996198] btrfs_ioctl_balance+0x2b9/0x3a0 [btrfs] [38.997084] btrfs_ioctl+0x11b0/0x2da0 [btrfs] [38.997867] ? mod_objcg_state+0xee/0x340 [38.998552] ? seq_release+0x24/0x30 [38.999184] ? proc_nr_files+0x30/0x30 [38.999654] ? call_rcu+0xc8/0x2f0 [39.000228] ? __x64_sys_ioctl+0x84/0xc0 [39.000872] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs] [39.001973] __x64_sys_ioctl+0x84/0xc0 [39.002566] do_syscall_64+0x3a/0x80 [39.003011] entry_SYSCALL_64_after_hwframe+0x44/0xae [39.003735] RIP: 0033:0x7f11c166959b [39.007324] RSP: 002b:00007fff2543e998 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [39.008521] RAX: ffffffffffffffda RBX: 00007f11c1521698 RCX: 00007f11c166959b [39.009833] RDX: 00007fff2543ea40 RSI: 00000000c4009420 RDI: 0000000000000003 [39.011270] RBP: 0000000000000003 R08: 0000000000000013 R09: 00007f11c16f94e0 [39.012581] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff25440df3 [39.014046] R13: 0000000000000000 R14: 00007fff2543ea40 R15: 0000000000000001 [39.015040] </TASK> [39.015418] ---[ end trace 0000000000000000 ]--- [43.131559] ------------[ cut here ]------------ [43.132234] kernel BUG at fs/btrfs/extent-tree.c:2717! [43.133031] invalid opcode: 0000 [#1] PREEMPT SMP PTI [43.133702] CPU: 1 PID: 1839 Comm: btrfs Tainted: G W 5.17.0-rc4 #54 [43.134863] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [43.136426] RIP: 0010:unpin_extent_range+0x37a/0x4f0 [btrfs] [43.139913] RSP: 0000:ffffb0dd4216bc70 EFLAGS: 00010246 [43.140629] RAX: 0000000000000000 RBX: ffff96cfc34490f8 RCX: 0000000000000001 [43.141604] RDX: 0000000080000001 RSI: 0000000051d00000 RDI: 00000000ffffffff [43.142645] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff96cfd07dca50 [43.143669] R10: ffff96cfc46e8a00 R11: fffffffffffec000 R12: 0000000041d00000 [43.144657] R13: ffff96cfc3ce0000 R14: ffffb0dd4216bd08 R15: 0000000000000000 [43.145686] FS: 00007f7657dd68c0(0000) GS:ffff96d6df640000(0000) knlGS:0000000000000000 [43.146808] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43.147584] CR2: 00007f7fe81bf5b0 CR3: 00000001093ee004 CR4: 0000000000370ee0 [43.148589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [43.149581] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000 ---truncated---2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix I/O page table memory leak The current logic updates the I/O page table mode for the domain before calling the logic to free memory used for the page table. This results in IOMMU page table memory leak, and can be observed when launching VM w/ pass-through devices. Fix by freeing the memory used for page table before updating the mode.2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: free reset-work-item when flushing Fix a tiny memory leak when flushing the reset work queue.2024-08-22not yet calculated





 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATA_FIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN timeout calculation: ================================================================================ UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events mptcp_worker Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330 mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline] __mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445 mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528 process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307 worker_thread+0x95/0xe10 kernel/workqueue.c:2454 kthread+0x2f4/0x3b0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> ================================================================================ This change limits the maximum timeout by limiting the size of the shift, which keeps all intermediate values in-bounds.2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: lcd2s: Fix memory leak in ->remove() Once allocated the struct lcd2s_data is never freed. Fix the memory leak by switching to devm_kzalloc().2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pci_id_table' reveals that this field is empty for some devices, which will cause null pointer dereference when initializing these devices. The following log reveals it: [ 3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci] [ 3.975181] Call Trace: [ 3.976208] local_pci_probe+0x13f/0x210 [ 3.977248] pci_device_probe+0x34c/0x6d0 [ 3.977255] ? pci_uevent+0x470/0x470 [ 3.978265] really_probe+0x24c/0x8d0 [ 3.978273] __driver_probe_device+0x1b3/0x280 [ 3.979288] driver_probe_device+0x50/0x370 Fix this by checking whether the 'ci' is a null pointer first.2024-08-22not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smc_release smc_connect_work if (sk->sk_state == SMC_INIT) send_clc_confirim tcp_abort(); ... sk.sk_state = SMC_ACTIVE smc_close_active switch(sk->sk_state) { ... case SMC_ACTIVE: smc_close_final() // then wait peer closed Unfortunately, tcp_abort() may discard CLC CONFIRM messages that are still in the tcp send buffer, in which case our connection token cannot be delivered to the server side, which means that we cannot get a passive close message at all. Therefore, it is impossible for the to be disconnected at all. This patch tries a very simple way to avoid this issue, once the state has changed to SMC_ACTIVE after tcp_abort(), we can actively abort the smc connection, considering that the state is SMC_INIT before tcp_abort(), abandoning the complete disconnection process should not cause too much problem. In fact, this problem may exist as long as the CLC CONFIRM message is not received by the server. Whether a timer should be added after smc_close_final() needs to be discussed in the future. But even so, this patch provides a faster release for connection in above case, it should also be valuable.2024-08-22not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ensure we call ipv6_mc_down() at most once There are two reasons for addrconf_notify() to be called with NETDEV_DOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them stays down while the other is toggled, we repeatedly call the code for NETDEV_DOWN, including ipv6_mc_down(), while never calling the corresponding ipv6_mc_up() in between. This will cause a new entry in idev->mc_tomb to be allocated for each multicast group the interface is subscribed to, which in turn leaks one struct ifmcaddr6 per nontrivial multicast group the interface is subscribed to. The following reproducer will leak at least $n objects: ip addr add ff2e::4242/32 dev eth0 autojoin sysctl -w net.ipv6.conf.eth0.disable_ipv6=1 for i in $(seq 1 $n); do ip link set up eth0; ip link set down eth0 done Joining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the sysctl net.ipv6.conf.eth0.forwarding to 1 (=> subscribing to ff02::2) can also be used to create a nontrivial idev->mc_list, which will the leak objects with the right up-down-sequence. Based on both sources for NETDEV_DOWN events the interface IPv6 state should be considered: - not ready if the network interface is not ready OR IPv6 is disabled for it - ready if the network interface is ready AND IPv6 is enabled for it The functions ipv6_mc_up() and ipv6_down() should only be run when this state changes. Implement this by remembering when the IPv6 state is ready, and only run ipv6_mc_down() if it actually changed from ready to not ready. The other direction (not ready -> ready) already works correctly, as: - the interface notification triggered codepath for NETDEV_UP / NETDEV_CHANGE returns early if ipv6 is disabled, and - the disable_ipv6=0 triggered codepath skips fully initializing the interface as long as addrconf_link_ready(dev) returns false - calling ipv6_mc_up() repeatedly does not leak anything2024-08-22not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: fix possible use-after-free Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change2024-08-22not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline] BUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:171 [inline] BUG: KASAN: use-after-free in __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438 Read of size 2 at addr ffff88801c1a8000 by task syz-executor237/4430 CPU: 1 PID: 4430 Comm: syz-executor237 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline] hooks_validate net/netfilter/core.c:171 [inline] __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438 nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571 nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587 nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218 synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81 xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038 check_target net/ipv6/netfilter/ip6_tables.c:530 [inline] find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:573 translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735 do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline] do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024 rawv6_setsockopt+0xd3/0x6a0 net/ipv6/raw.c:1084 __sys_setsockopt+0x2db/0x610 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f65a1ace7d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f65a1a7f308 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f65a1ace7d9 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 00007f65a1b574c8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 00007f65a1b55130 R13: 00007f65a1b574c0 R14: 00007f65a1b24090 R15: 0000000000022000 </TASK> The buggy address belongs to the page: page:ffffea0000706a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c1a8 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001c1b108 ffffea000046dd08 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 4430, ts 1061781545818, free_ts 1061791488993 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 __alloc_pages_node include/linux/gfp.h:572 [inline] alloc_pages_node include/linux/gfp.h:595 [inline] kmalloc_large_node+0x62/0x130 mm/slub.c:4438 __kmalloc_node+0x35a/0x4a0 mm/slub. ---truncated---2024-08-22not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blk_trace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q->debugfs_dir' and 'bt->dir' is NULL, thus blk_trace_free() won't remove those files. What's worse, the following UAF can be triggered because of accessing stale 'dropped' and 'msg': ================================================================== BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100 Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188 CPU: 27 PID: 1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xab/0x381 ? blk_dropped_read+0x89/0x100 ? blk_dropped_read+0x89/0x100 kasan_report.cold+0x83/0xdf ? blk_dropped_read+0x89/0x100 kasan_check_range+0x140/0x1b0 blk_dropped_read+0x89/0x100 ? blk_create_buf_file_callback+0x20/0x20 ? kmem_cache_free+0xa1/0x500 ? do_sys_openat2+0x258/0x460 full_proxy_read+0x8f/0xc0 vfs_read+0xc6/0x260 ksys_read+0xb9/0x150 ? vfs_write+0x3d0/0x3d0 ? fpregs_assert_state_consistent+0x55/0x60 ? exit_to_user_mode_prepare+0x39/0x1e0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbc080d92fd Code: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1 RSP: 002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fbb95ff9dc0 RCX: 00007fbc080d92fd RDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045 RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd R10: 000000000153afa0 R11: 0000000000000293 R12: 00007fbb780008c0 R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8 </TASK> Allocated by task 1050: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 do_blk_trace_setup+0xcb/0x410 __blk_trace_setup+0xac/0x130 blk_trace_ioctl+0xe9/0x1c0 blkdev_ioctl+0xf1/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 1050: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x103/0x180 kfree+0x9a/0x4c0 __blk_trace_remove+0x53/0x70 blk_trace_ioctl+0x199/0x1c0 blkdev_common_ioctl+0x5e9/0xb30 blkdev_ioctl+0x1a5/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88816912f380 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 88 bytes inside of 96-byte region [ffff88816912f380, ffff88816912f3e0) The buggy address belongs to the page: page:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88816912f280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ==================================================================2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: destroy queues before real_num_tx_queues is zeroed xennet_destroy_queues() relies on info->netdev->real_num_tx_queues to delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 ("net-sysfs: update the queue counts in the unregistration path"), unregister_netdev() indirectly sets real_num_tx_queues to 0. Those two facts together means, that xennet_destroy_queues() called from xennet_remove() cannot do its job, because it's called after unregister_netdev(). This results in kfree-ing queues that are still linked in napi, which ultimately crashes: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 52 Comm: xenwatch Tainted: G W 5.16.10-1.32.fc32.qubes.x86_64+ #226 RIP: 0010:free_netdev+0xa3/0x1a0 Code: ff 48 89 df e8 2e e9 00 00 48 8b 43 50 48 8b 08 48 8d b8 a0 fe ff ff 48 8d a9 a0 fe ff ff 49 39 c4 75 26 eb 47 e8 ed c1 66 ff <48> 8b 85 60 01 00 00 48 8d 95 60 01 00 00 48 89 ef 48 2d 60 01 00 RSP: 0000:ffffc90000bcfd00 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88800edad000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffc90000bcfc30 RDI: 00000000ffffffff RBP: fffffffffffffea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800edad050 R13: ffff8880065f8f88 R14: 0000000000000000 R15: ffff8880066c6680 FS: 0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000e998c006 CR4: 00000000003706e0 Call Trace: <TASK> xennet_remove+0x13d/0x300 [xen_netfront] xenbus_dev_remove+0x6d/0xf0 __device_release_driver+0x17a/0x240 device_release_driver+0x24/0x30 bus_remove_device+0xd8/0x140 device_del+0x18b/0x410 ? _raw_spin_unlock+0x16/0x30 ? klist_iter_exit+0x14/0x20 ? xenbus_dev_request_and_reply+0x80/0x80 device_unregister+0x13/0x60 xenbus_dev_changed+0x18e/0x1f0 xenwatch_thread+0xc0/0x1a0 ? do_wait_intr_irq+0xa0/0xa0 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Fix this by calling xennet_destroy_queues() from xennet_uninit(), when real_num_tx_queues is still available. This ensures that queues are destroyed when real_num_tx_queues is set to 0, regardless of how unregister_netdev() was called. Originally reported at https://github.com/QubesOS/qubes-issues/issues/72572024-08-22not yet calculated





 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Do not call get_trip_hyst() from thermal_genl_cmd_tz_get_trip() if the thermal zone does not define one.2024-08-22not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix double list_add when enabling VMD in scalable mode When enabling VMD and IOMMU scalable mode, the following kernel panic call trace/kernel log is shown in Eagle Stream platform (Sapphire Rapids CPU) during booting: pci 0000:59:00.5: Adding to iommu group 42 ... vmd 0000:59:00.5: PCI host bridge to bus 10000:80 pci 10000:80:01.0: [8086:352a] type 01 class 0x060400 pci 10000:80:01.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:01.0: enabling Extended Tags pci 10000:80:01.0: PME# supported from D0 D3hot D3cold pci 10000:80:01.0: DMAR: Setup RID2PASID failed pci 10000:80:01.0: Failed to add to iommu group 42: -16 pci 10000:80:03.0: [8086:352b] type 01 class 0x060400 pci 10000:80:03.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:03.0: enabling Extended Tags pci 10000:80:03.0: PME# supported from D0 D3hot D3cold ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-rc3+ #7 Hardware name: Lenovo ThinkSystem SR650V3/SB27A86647, BIOS ESE101Y-1.00 01/13/2022 Workqueue: events work_for_cpu_fn RIP: 0010:__list_add_valid.cold+0x26/0x3f Code: 9a 4a ab ff 4c 89 c1 48 c7 c7 40 0c d9 9e e8 b9 b1 fe ff 0f 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 f0 0c d9 9e e8 a2 b1 fe ff <0f> 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 98 0c d9 9e e8 8b b1 fe RSP: 0000:ff5ad434865b3a40 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ff4d61160b74b880 RCX: ff4d61255e1fffa8 RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff9fd34f20 RBP: ff4d611d8e245c00 R08: 0000000000000000 R09: ff5ad434865b3888 R10: ff5ad434865b3880 R11: ff4d61257fdc6fe8 R12: ff4d61160b74b8a0 R13: ff4d61160b74b8a0 R14: ff4d611d8e245c10 R15: ff4d611d8001ba70 FS: 0000000000000000(0000) GS:ff4d611d5ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff4d611fa1401000 CR3: 0000000aa0210001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> intel_pasid_alloc_table+0x9c/0x1d0 dmar_insert_one_dev_info+0x423/0x540 ? device_to_iommu+0x12d/0x2f0 intel_iommu_attach_device+0x116/0x290 __iommu_attach_device+0x1a/0x90 iommu_group_add_device+0x190/0x2c0 __iommu_probe_device+0x13e/0x250 iommu_probe_device+0x24/0x150 iommu_bus_notifier+0x69/0x90 blocking_notifier_call_chain+0x5a/0x80 device_add+0x3db/0x7b0 ? arch_memremap_can_ram_remap+0x19/0x50 ? memremap+0x75/0x140 pci_device_add+0x193/0x1d0 pci_scan_single_device+0xb9/0xf0 pci_scan_slot+0x4c/0x110 pci_scan_child_bus_extend+0x3a/0x290 vmd_enable_domain.constprop.0+0x63e/0x820 vmd_probe+0x163/0x190 local_pci_probe+0x42/0x80 work_for_cpu_fn+0x13/0x20 process_one_work+0x1e2/0x3b0 worker_thread+0x1c4/0x3a0 ? rescuer_thread+0x370/0x370 kthread+0xc7/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The following 'lspci' output shows devices '10000:80:*' are subdevices of the VMD device 0000:59:00.5: $ lspci ... 0000:59:00.5 RAID bus controller: Intel Corporation Volume Management Device NVMe RAID Controller (rev 20) ... 10000:80:01.0 PCI bridge: Intel Corporation Device 352a (rev 03) 10000:80:03.0 PCI bridge: Intel Corporation Device 352b (rev 03) 10000:80:05.0 PCI bridge: Intel Corporation Device 352c (rev 03) 10000:80:07.0 PCI bridge: Intel Corporation Device 352d (rev 03) 10000:81:00.0 Non-Volatile memory controller: Intel Corporation NVMe Datacenter SSD [3DNAND, Beta Rock Controller] 10000:82:00 ---truncated---2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min While the $val/$val2 values passed in from userspace are always >= 0 integers, the limits of the control can be signed integers and the $min can be non-zero and less than zero. To correctly validate $val/$val2 against platform_max, add the $min offset to val first.2024-08-22not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mvm: check debugfs_dir ptr before use When "debugfs=off" is used on the kernel command line, iwiwifi's mvm module uses an invalid/unchecked debugfs_dir pointer and causes a BUG: BUG: kernel NULL pointer dereference, address: 000000000000004f #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 503 Comm: modprobe Tainted: G W 5.17.0-rc5 #7 Hardware name: Dell Inc. Inspiron 15 5510/076F7Y, BIOS 2.4.1 11/05/2021 RIP: 0010:iwl_mvm_dbgfs_register+0x692/0x700 [iwlmvm] Code: 69 a0 be 80 01 00 00 48 c7 c7 50 73 6a a0 e8 95 cf ee e0 48 8b 83 b0 1e 00 00 48 c7 c2 54 73 6a a0 be 64 00 00 00 48 8d 7d 8c <48> 8b 48 50 e8 15 22 07 e1 48 8b 43 28 48 8d 55 8c 48 c7 c7 5f 73 RSP: 0018:ffffc90000a0ba68 EFLAGS: 00010246 RAX: ffffffffffffffff RBX: ffff88817d6e3328 RCX: ffff88817d6e3328 RDX: ffffffffa06a7354 RSI: 0000000000000064 RDI: ffffc90000a0ba6c RBP: ffffc90000a0bae0 R08: ffffffff824e4880 R09: ffffffffa069d620 R10: ffffc90000a0ba00 R11: ffffffffffffffff R12: 0000000000000000 R13: ffffc90000a0bb28 R14: ffff88817d6e3328 R15: ffff88817d6e3320 FS: 00007f64dd92d740(0000) GS:ffff88847f640000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004f CR3: 000000016fc79001 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: <TASK> ? iwl_mvm_mac_setup_register+0xbdc/0xda0 [iwlmvm] iwl_mvm_start_post_nvm+0x71/0x100 [iwlmvm] iwl_op_mode_mvm_start+0xab8/0xb30 [iwlmvm] _iwl_op_mode_start+0x6f/0xd0 [iwlwifi] iwl_opmode_register+0x6a/0xe0 [iwlwifi] ? 0xffffffffa0231000 iwl_mvm_init+0x35/0x1000 [iwlmvm] ? 0xffffffffa0231000 do_one_initcall+0x5a/0x1b0 ? kmem_cache_alloc+0x1e5/0x2f0 ? do_init_module+0x1e/0x220 do_init_module+0x48/0x220 load_module+0x2602/0x2bc0 ? __kernel_read+0x145/0x2e0 ? kernel_read_file+0x229/0x290 __do_sys_finit_module+0xc5/0x130 ? __do_sys_finit_module+0xc5/0x130 __x64_sys_finit_module+0x13/0x20 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f64dda564dd Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1b 29 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdba393f88 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f64dda564dd RDX: 0000000000000000 RSI: 00005575399e2ab2 RDI: 0000000000000001 RBP: 000055753a91c5e0 R08: 0000000000000000 R09: 0000000000000002 R10: 0000000000000001 R11: 0000000000000246 R12: 00005575399e2ab2 R13: 000055753a91ceb0 R14: 0000000000000000 R15: 000055753a923018 </TASK> Modules linked in: btintel(+) btmtk bluetooth vfat snd_hda_codec_hdmi fat snd_hda_codec_realtek snd_hda_codec_generic iwlmvm(+) snd_sof_pci_intel_tgl mac80211 snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence soundwire_bus snd_sof_intel_hda snd_sof_pci snd_sof snd_sof_xtensa_dsp snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core btrfs snd_compress snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec raid6_pq iwlwifi snd_hda_core snd_pcm snd_timer snd soundcore cfg80211 intel_ish_ipc(+) thunderbolt rfkill intel_ishtp ucsi_acpi wmi i2c_hid_acpi i2c_hid evdev CR2: 000000000000004f ---[ end trace 0000000000000000 ]--- Check the debugfs_dir pointer for an error before using it. [change to make both conditional]2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0 [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4 [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [Thu Feb 10 12:59:06 2022] Call Trace: [Thu Feb 10 12:59:06 2022] <IRQ> [Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78 [Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0 [Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0 [Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0 [Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20 [Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140 [Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10 [Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b [Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150 [Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30 [Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0 ... [Thu Feb 10 12:59:07 2022] Freed by task 58179: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30 [Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40 [Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170 [Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20 [Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0 [Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae [Thu Feb 10 12:59:07 2022] Last potentially related work creation: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0 [Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10 [Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0 [Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae2024-08-22not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: get rid of warning on transaction commit when using flushoncommit When using the flushoncommit mount option, during almost every transaction commit we trigger a warning from __writeback_inodes_sb_nr(): $ cat fs/fs-writeback.c: (...) static void __writeback_inodes_sb_nr(struct super_block *sb, ... { (...) WARN_ON(!rwsem_is_locked(&sb->s_umount)); (...) } (...) The trace produced in dmesg looks like the following: [947.473890] WARNING: CPU: 5 PID: 930 at fs/fs-writeback.c:2610 __writeback_inodes_sb_nr+0x7e/0xb3 [947.481623] Modules linked in: nfsd nls_cp437 cifs asn1_decoder cifs_arc4 fscache cifs_md4 ipmi_ssif [947.489571] CPU: 5 PID: 930 Comm: btrfs-transacti Not tainted 95.16.3-srb-asrock-00001-g36437ad63879 #186 [947.497969] RIP: 0010:__writeback_inodes_sb_nr+0x7e/0xb3 [947.502097] Code: 24 10 4c 89 44 24 18 c6 (...) [947.519760] RSP: 0018:ffffc90000777e10 EFLAGS: 00010246 [947.523818] RAX: 0000000000000000 RBX: 0000000000963300 RCX: 0000000000000000 [947.529765] RDX: 0000000000000000 RSI: 000000000000fa51 RDI: ffffc90000777e50 [947.535740] RBP: ffff888101628a90 R08: ffff888100955800 R09: ffff888100956000 [947.541701] R10: 0000000000000002 R11: 0000000000000001 R12: ffff888100963488 [947.547645] R13: ffff888100963000 R14: ffff888112fb7200 R15: ffff888100963460 [947.553621] FS: 0000000000000000(0000) GS:ffff88841fd40000(0000) knlGS:0000000000000000 [947.560537] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [947.565122] CR2: 0000000008be50c4 CR3: 000000000220c000 CR4: 00000000001006e0 [947.571072] Call Trace: [947.572354] <TASK> [947.573266] btrfs_commit_transaction+0x1f1/0x998 [947.576785] ? start_transaction+0x3ab/0x44e [947.579867] ? schedule_timeout+0x8a/0xdd [947.582716] transaction_kthread+0xe9/0x156 [947.585721] ? btrfs_cleanup_transaction.isra.0+0x407/0x407 [947.590104] kthread+0x131/0x139 [947.592168] ? set_kthread_struct+0x32/0x32 [947.595174] ret_from_fork+0x22/0x30 [947.597561] </TASK> [947.598553] ---[ end trace 644721052755541c ]--- This is because we started using writeback_inodes_sb() to flush delalloc when committing a transaction (when using -o flushoncommit), in order to avoid deadlocks with filesystem freeze operations. This change was made by commit ce8ea7cc6eb313 ("btrfs: don't call btrfs_start_delalloc_roots in flushoncommit"). After that change we started producing that warning, and every now and then a user reports this since the warning happens too often, it spams dmesg/syslog, and a user is unsure if this reflects any problem that might compromise the filesystem's reliability. We can not just lock the sb->s_umount semaphore before calling writeback_inodes_sb(), because that would at least deadlock with filesystem freezing, since at fs/super.c:freeze_super() sync_filesystem() is called while we are holding that semaphore in write mode, and that can trigger a transaction commit, resulting in a deadlock. It would also trigger the same type of deadlock in the unmount path. Possibly, it could also introduce some other locking dependencies that lockdep would report. To fix this call try_to_writeback_inodes_sb() instead of writeback_inodes_sb(), because that will try to read lock sb->s_umount and then will only call writeback_inodes_sb() if it was able to lock it. This is fine because the cases where it can't read lock sb->s_umount are during a filesystem unmount or during a filesystem freeze - in those cases sb->s_umount is write locked and sync_filesystem() is called, which calls writeback_inodes_sb(). In other words, in all cases where we can't take a read lock on sb->s_umount, writeback is already being triggered elsewhere. An alternative would be to call btrfs_start_delalloc_roots() with a number of pages different from LONG_MAX, for example matching the number of delalloc bytes we currently have, in ---truncated---2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRIO_PGRP, 0, -20), wait, and exit. For each of the new threads the copy_process() gets invoked, which adds the new task_struct and calls sched_post_fork() for it. In the above scenario there is a possibility that setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread in the group that is just being created by copy_process(), and for which the sched_post_fork() has not been executed yet. This will trigger a null pointer dereference in reweight_entity(), as it will try to access the run queue pointer, which hasn't been set. Before the mentioned change the cfs_rq pointer for the task has been set in sched_fork(), which is called much earlier in copy_process(), before the new task is added to the thread_group. Now it is done in the sched_post_fork(), which is called after that. To fix the issue the remove the update_load param from the update_load param() function and call reweight_task() only if the task flag doesn't have the TASK_NEW flag set.2024-08-22not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: riscv: fix oops caused by irqsoff latency tracer The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (aka. __builtin_return_address(1)) to acquire caller info. If the $fp is used for other purpose, the code generated this macro (as below) could trigger memory access fault. 0xffffffff8011510e <+80>: ld a1,-16(s0) 0xffffffff80115112 <+84>: ld s2,-8(a1) # <-- paging fault here The oops message during booting if compiled with 'irqoff' tracer enabled: [ 0.039615][ T0] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 [ 0.041925][ T0] Oops [#1] [ 0.042063][ T0] Modules linked in: [ 0.042864][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-rc1-00233-g9a20c48d1ed2 #29 [ 0.043568][ T0] Hardware name: riscv-virtio,qemu (DT) [ 0.044343][ T0] epc : trace_hardirqs_on+0x56/0xe2 [ 0.044601][ T0] ra : restore_all+0x12/0x6e [ 0.044721][ T0] epc : ffffffff80126a5c ra : ffffffff80003b94 sp : ffffffff81403db0 [ 0.044801][ T0] gp : ffffffff8163acd8 tp : ffffffff81414880 t0 : 0000000000000020 [ 0.044882][ T0] t1 : 0098968000000000 t2 : 0000000000000000 s0 : ffffffff81403de0 [ 0.044967][ T0] s1 : 0000000000000000 a0 : 0000000000000001 a1 : 0000000000000100 [ 0.045046][ T0] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.045124][ T0] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000054494d45 [ 0.045210][ T0] s2 : ffffffff80003b94 s3 : ffffffff81a8f1b0 s4 : ffffffff80e27b50 [ 0.045289][ T0] s5 : ffffffff81414880 s6 : ffffffff8160fa00 s7 : 00000000800120e8 [ 0.045389][ T0] s8 : 0000000080013100 s9 : 000000000000007f s10: 0000000000000000 [ 0.045474][ T0] s11: 0000000000000000 t3 : 7fffffffffffffff t4 : 0000000000000000 [ 0.045548][ T0] t5 : 0000000000000000 t6 : ffffffff814aa368 [ 0.045620][ T0] status: 0000000200000100 badaddr: 00000000000000f8 cause: 000000000000000d [ 0.046402][ T0] [<ffffffff80003b94>] restore_all+0x12/0x6e This because the $fp(aka. $s0) register is not used as frame pointer in the assembly entry code. resume_kernel: REG_L s0, TASK_TI_PREEMPT_COUNT(tp) bnez s0, restore_all REG_L s0, TASK_TI_FLAGS(tp) andi s0, s0, _TIF_NEED_RESCHED beqz s0, restore_all call preempt_schedule_irq j restore_all To fix above issue, here we add one extra level wrapper for function trace_hardirqs_{on,off}() so they can be safely called by low level entry code.2024-08-22not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: prevent copying too big compressed lzo segment Compressed length can be corrupted to be a lot larger than memory we have allocated for buffer. This will cause memcpy in copy_compressed_segment to write outside of allocated memory. This mostly results in stuck read syscall but sometimes when using btrfs send can get #GP kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P OE 5.17.0-rc2-1 #12 kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs] kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs Code starting with the faulting instruction =========================================== 0:* 48 8b 06 mov (%rsi),%rax <-- trapping instruction 3: 48 8d 79 08 lea 0x8(%rcx),%rdi 7: 48 83 e7 f8 and $0xfffffffffffffff8,%rdi b: 48 89 01 mov %rax,(%rcx) e: 44 89 f0 mov %r14d,%eax 11: 48 8b 54 06 f8 mov -0x8(%rsi,%rax,1),%rdx kernel: RSP: 0018:ffffb110812efd50 EFLAGS: 00010212 kernel: RAX: 0000000000001000 RBX: 000000009ca264c8 RCX: ffff98996e6d8ff8 kernel: RDX: 0000000000000064 RSI: 000841551d5c1000 RDI: ffffffff9500435d kernel: RBP: ffff989a3be856c0 R08: 0000000000000000 R09: 0000000000000000 kernel: R10: 0000000000000000 R11: 0000000000001000 R12: ffff98996e6d8000 kernel: R13: 0000000000000008 R14: 0000000000001000 R15: 000841551d5c1000 kernel: FS: 0000000000000000(0000) GS:ffff98a09d640000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 00001e9f984d9ea8 CR3: 000000014971a000 CR4: 00000000003506e0 kernel: Call Trace: kernel: <TASK> kernel: end_compressed_bio_read (fs/btrfs/compression.c:104 fs/btrfs/compression.c:1363 fs/btrfs/compression.c:323) btrfs kernel: end_workqueue_fn (fs/btrfs/disk-io.c:1923) btrfs kernel: btrfs_work_helper (fs/btrfs/async-thread.c:326) btrfs kernel: process_one_work (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:212 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2312) kernel: worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2455) kernel: ? process_one_work (kernel/workqueue.c:2397) kernel: kthread (kernel/kthread.c:377) kernel: ? kthread_complete_and_exit (kernel/kthread.c:332) kernel: ret_from_fork (arch/x86/entry/entry_64.S:301) kernel: </TASK>2024-08-22not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: fix memory leak in int3400_notify() It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", pid 112, jiffies 4294893323 (age 83.604s) hex dump (first 32 bytes): 4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 54 68 65 NAME=INT3400 The 72 6d 61 6c 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 rmal.kkkkkkkkkk. backtrace: [<ffffffff9c502c3e>] __kmalloc_track_caller+0x2fe/0x4a0 [<ffffffff9c7b7c15>] kvasprintf+0x65/0xd0 [<ffffffff9c7b7d6e>] kasprintf+0x4e/0x70 [<ffffffffc04cb662>] int3400_notify+0x82/0x120 [int3400_thermal] [<ffffffff9c8b7358>] acpi_ev_notify_dispatch+0x54/0x71 [<ffffffff9c88f1a7>] acpi_os_execute_deferred+0x17/0x30 [<ffffffff9c2c2c0a>] process_one_work+0x21a/0x3f0 [<ffffffff9c2c2e2a>] worker_thread+0x4a/0x3b0 [<ffffffff9c2cb4dd>] kthread+0xfd/0x130 [<ffffffff9c201c1f>] ret_from_fork+0x1f/0x30 Fix it by calling kfree() accordingly.2024-08-22not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.2024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() In Google internal bug 265639009 we've received an (as yet) unreproducible crash report from an aarch64 GKI 5.10.149-android13 running device. AFAICT the source code is at: https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 The call stack is: ncm_close() -> ncm_notify() -> ncm_do_notify() with the crash at: ncm_do_notify+0x98/0x270 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) 0B 0D 00 79 strh w11, [x8, #6] // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) 6C 0A 00 B9 str w12, [x19, #8] // x10 (NULL) was read here from offset 0 of valid pointer x9 // IMHO we're reading 'cdev->gadget' and getting NULL // gadget is indeed at offset 0 of struct usb_composite_dev 2A 01 40 F9 ldr x10, [x9] // loading req->buf pointer, which is at offset 0 of struct usb_request 69 02 40 F9 ldr x9, [x19] // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed 4B 5D 40 B9 ldr w11, [x10, #0x5c] which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: event->wLength = cpu_to_le16(8); req->length = NCM_STATUS_BYTECOUNT; /* SPEED_CHANGE data is up/down speeds in bits/sec */ data = req->buf + sizeof *event; data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); My analysis of registers and NULL ptr deref crash offset (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); which calls: ncm_bitrate(NULL) which then calls: gadget_is_superspeed(NULL) which reads ((struct usb_gadget *)NULL)->max_speed and hits a panic. AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. (remember there's a GKI KABI reservation of 16 bytes in struct work_struct) It's not at all clear to me how this is all supposed to work... but returning 0 seems much better than panic-ing...2024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota rescan and disable leading to NULL pointer deref If we have one task trying to start the quota rescan worker while another one is trying to disable quotas, we can end up hitting a race that results in the quota rescan worker doing a NULL pointer dereference. The steps for this are the following: 1) Quotas are enabled; 2) Task A calls the quota rescan ioctl and enters btrfs_qgroup_rescan(). It calls qgroup_rescan_init() which returns 0 (success) and then joins a transaction and commits it; 3) Task B calls the quota disable ioctl and enters btrfs_quota_disable(). It clears the bit BTRFS_FS_QUOTA_ENABLED from fs_info->flags and calls btrfs_qgroup_wait_for_completion(), which returns immediately since the rescan worker is not yet running. Then it starts a transaction and locks fs_info->qgroup_ioctl_lock; 4) Task A queues the rescan worker, by calling btrfs_queue_work(); 5) The rescan worker starts, and calls rescan_should_stop() at the start of its while loop, which results in 0 iterations of the loop, since the flag BTRFS_FS_QUOTA_ENABLED was cleared from fs_info->flags by task B at step 3); 6) Task B sets fs_info->quota_root to NULL; 7) The rescan worker tries to start a transaction and uses fs_info->quota_root as the root argument for btrfs_start_transaction(). This results in a NULL pointer dereference down the call chain of btrfs_start_transaction(). The stack trace is something like the one reported in Link tag below: general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f] CPU: 1 PID: 34 Comm: kworker/u4:2 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: btrfs-qgroup-rescan btrfs_work_helper RIP: 0010:start_transaction+0x48/0x10f0 fs/btrfs/transaction.c:564 Code: 48 89 fb 48 (...) RSP: 0018:ffffc90000ab7ab0 EFLAGS: 00010206 RAX: 0000000000000041 RBX: 0000000000000208 RCX: ffff88801779ba80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000001 R09: fffff52000156f5d R10: fffff52000156f5d R11: 1ffff92000156f5c R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2bea75b718 CR3: 000000001d0cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> btrfs_qgroup_rescan_worker+0x3bb/0x6a0 fs/btrfs/qgroup.c:3402 btrfs_work_helper+0x312/0x850 fs/btrfs/async-thread.c:280 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK> Modules linked in: So fix this by having the rescan worker function not attempt to start a transaction if it didn't do any rescan work.2024-08-21not yet calculated




 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: do not warn on record without old_roots populated [BUG] There are some reports from the mailing list that since v6.1 kernel, the WARN_ON() inside btrfs_qgroup_account_extent() gets triggered during rescan: WARNING: CPU: 3 PID: 6424 at fs/btrfs/qgroup.c:2756 btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] CPU: 3 PID: 6424 Comm: snapperd Tainted: P OE 6.1.2-1-default #1 openSUSE Tumbleweed 05c7a1b1b61d5627475528f71f50444637b5aad7 RIP: 0010:btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] Call Trace: <TASK> btrfs_commit_transaction+0x30c/0xb40 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? start_transaction+0xc3/0x5b0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_qgroup_rescan+0x42/0xc0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_ioctl+0x1ab9/0x25c0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? __rseq_handle_notify_resume+0xa9/0x4a0 ? mntput_no_expire+0x4a/0x240 ? __seccomp_filter+0x319/0x4d0 __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x5b/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd9b790d9bf </TASK> [CAUSE] Since commit e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), if our qgroup is already in inconsistent state, we will no longer do the time-consuming backref walk. This can leave some qgroup records without a valid old_roots ulist. Normally this is fine, as btrfs_qgroup_account_extents() would also skip those records if we have NO_ACCOUNTING flag set. But there is a small window, if we have NO_ACCOUNTING flag set, and inserted some qgroup_record without a old_roots ulist, but then the user triggered a qgroup rescan. During btrfs_qgroup_rescan(), we firstly clear NO_ACCOUNTING flag, then commit current transaction. And since we have a qgroup_record with old_roots = NULL, we trigger the WARN_ON() during btrfs_qgroup_account_extents(). [FIX] Unfortunately due to the introduction of NO_ACCOUNTING flag, the assumption that every qgroup_record would have its old_roots populated is no longer correct. Fix the false alerts and drop the WARN_ON().2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies. Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back. hold the xhci spinlock while freeing the virt device2024-08-21not yet calculated





 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: Add exception protection processing for vd in axi_chan_handle_err function Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases. You can refer to the processing of axi_chan_block_xfer_complete function The triggered kernel panic is as follows: [ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.848449] ESR = 0x96000004 [ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits [ 67.848454] SET = 0, FnV = 0 [ 67.848456] EA = 0, S1PTW = 0 [ 67.848458] Data abort info: [ 67.848460] ISV = 0, ISS = 0x00000004 [ 67.848462] CM = 0, WnR = 0 [ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000 [ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000 [ 67.848472] Internal error: Oops: 96000004 [#1] SMP [ 67.848475] Modules linked in: dmatest [ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11 [ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--) [ 67.848487] pc : axi_chan_handle_err+0xc4/0x230 [ 67.848491] lr : axi_chan_handle_err+0x30/0x230 [ 67.848493] sp : ffff0803fe55ae50 [ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200 [ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080 [ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850 [ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000 [ 67.848512] x21: 0000000000000080 x20: 0000000000002000 [ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000 [ 67.848521] x17: 0000000000000000 x16: 0000000000000000 [ 67.848525] x15: 0000000000000000 x14: 0000000000000000 [ 67.848529] x13: 0000000000000000 x12: 0000000000000040 [ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a [ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270 [ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0 [ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480 [ 67.848550] x3 : dead000000000100 x2 : dead000000000122 [ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168 [ 67.848559] Call trace: [ 67.848562] axi_chan_handle_err+0xc4/0x230 [ 67.848566] dw_axi_dma_interrupt+0xf4/0x590 [ 67.848569] __handle_irq_event_percpu+0x60/0x220 [ 67.848573] handle_irq_event+0x64/0x120 [ 67.848576] handle_fasteoi_irq+0xc4/0x220 [ 67.848580] __handle_domain_irq+0x80/0xe0 [ 67.848583] gic_handle_irq+0xc0/0x138 [ 67.848585] el1_irq+0xc8/0x180 [ 67.848588] arch_cpu_idle+0x14/0x2c [ 67.848591] default_idle_call+0x40/0x16c [ 67.848594] do_idle+0x1f0/0x250 [ 67.848597] cpu_startup_entry+0x2c/0x60 [ 67.848600] rest_init+0xc0/0xcc [ 67.848603] arch_call_rest_init+0x14/0x1c [ 67.848606] start_kernel+0x4cc/0x500 [ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1) [ 67.848613] ---[ end trace 585a97036f88203a ]---2024-08-21not yet calculated





 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix general protection fault in nilfs_btree_insert() If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted. By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be.2024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check endpoint is valid before dereferencing it When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint. Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it. [233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 [233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270 [233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x1982024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: nommu: fix memory leak in do_mmap() error path The preallocation of the maple tree nodes may leak if the error path to "error_just_free" is taken. Fix this by moving the freeing of the maple tree nodes to a shared location for all error paths.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: io_uring: lock overflowing for IOPOLL syzbot reports an issue with overflow filling for IOPOLL: WARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734 CPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Workqueue: events_unbound io_ring_exit_work Call trace:  io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734  io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773  io_fill_cqe_req io_uring/io_uring.h:168 [inline]  io_do_iopoll+0x474/0x62c io_uring/rw.c:1065  io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513  io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056  io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869  process_one_work+0x2d8/0x504 kernel/workqueue.c:2289  worker_thread+0x340/0x610 kernel/workqueue.c:2436  kthread+0x12c/0x158 kernel/kthread.c:376  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863 There is no real problem for normal IOPOLL as flush is also called with uring_lock taken, but it's getting more complicated for IOPOLL|SQPOLL, for which __io_cqring_overflow_flush() happens from the CQ waiting path.2024-08-21not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate() The subs function argument may be NULL, so do not use it before the NULL check.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix resource leakage in VF driver unbind resources allocated like mcam entries to support the Ntuple feature and hash tables for the tc feature are not getting freed in driver unbind. This patch fixes the issue.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mpls: Fix warning during failed attribute validation The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above 'struct nla_policy': " Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN: NLA_BINARY Validation function called for the attribute. All other Unused - but note that it's a union " This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32' type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate' field. Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function. No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0 [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace: <TASK> __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd2024-08-21not yet calculated




 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in dummy_timer Call Trace: memcpy (mm/kasan/shadow.c:65) dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352) transfer (drivers/usb/gadget/udc/dummy_hcd.c:1453) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972) arch_static_branch (arch/x86/include/asm/jump_label.h:27) static_key_false (include/linux/jump_label.h:207) timer_expire_exit (include/trace/events/timer.h:127) call_timer_fn (kernel/time/timer.c:1475) expire_timers (kernel/time/timer.c:1519) __run_timers (kernel/time/timer.c:1790) run_timer_softirq (kernel/time/timer.c:1803)2024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL dereference Fix potential NULL dereference, in the case when "man", the resource manager might be NULL, when/if we print debug information.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of cached open files in nfsd4_open codepath Commit fb70bf124b05 ("NFSD: Instantiate a struct file when creating a regular NFSv4 file") added the ability to cache an open fd over a compound. There are a couple of problems with the way this currently works: It's racy, as a newly-created nfsd_file can end up with its PENDING bit cleared while the nf is hashed, and the nf_file pointer is still zeroed out. Other tasks can find it in this state and they expect to see a valid nf_file, and can oops if nf_file is NULL. Also, there is no guarantee that we'll end up creating a new nfsd_file if one is already in the hash. If an extant entry is in the hash with a valid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with the value of op_file and the old nf_file will leak. Fix both issues by making a new nfsd_file_acquirei_opened variant that takes an optional file pointer. If one is present when this is called, we'll take a new reference to it instead of trying to open the file. If the nfsd_file already has a valid nf_file, we'll just ignore the optional file and pass the nfsd_file back as-is. Also rework the tracepoints a bit to allow for an "opened" variant and don't try to avoid counting acquisitions in the case where we already have a cached open file.2024-08-21not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an issue that retry_pfn overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will overflow. As a result, if the retry logic is executed, low_pfn is updated to 0, and then new_pfn < low_pfn returns false to make the allocation successful. This issue occurs in the following two situations: 1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cached_node is assigned as iovad->anchor. For example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfn_lo is smaller than iovad->cached_node. Example log as follows: [ 223.798112][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff 2. The node with the largest iova->pfn_lo value in the iova domain is deleted, iovad->cached_node will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain. After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 to fix the overflow issue.2024-08-21not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/msm: another fix for the headless Adreno GPU Fix another oops reproducible when rebooting the board with the Adreno GPU working in the headless mode (e.g. iMX platforms). Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=74936831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] ARM CPU: 0 PID: 51 Comm: reboot Not tainted 6.2.0-rc1-dirty #11 Hardware name: Freescale i.MX53 (Device Tree Support) PC is at msm_atomic_commit_tail+0x50/0x970 LR is at commit_tail+0x9c/0x188 pc : [<c06aa430>] lr : [<c067a214>] psr: 600e0013 sp : e0851d30 ip : ee4eb7eb fp : 00090acc r10: 00000058 r9 : c2193014 r8 : c4310000 r7 : c4759380 r6 : 07bef61d r5 : 00000000 r4 : 00000000 r3 : c44cc440 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 74910019 DAC: 00000051 Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: slab kmalloc-1k start c44cc400 pointer offset 64 size 1024 Register r4 information: NULL pointer Register r5 information: NULL pointer Register r6 information: non-paged memory Register r7 information: slab kmalloc-128 start c4759380 pointer offset 0 size 128 Register r8 information: slab kmalloc-2k start c4310000 pointer offset 0 size 2048 Register r9 information: non-slab/vmalloc memory Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: non-paged memory Process reboot (pid: 51, stack limit = 0xc80046d9) Stack: (0xe0851d30 to 0xe0852000) 1d20: c4759380 fbd77200 000005ff 002b9c70 1d40: c4759380 c4759380 00000000 07bef61d 00000600 c0d6fe7c c2193014 00000058 1d60: 00090acc c067a214 00000000 c4759380 c4310000 00000000 c44cc854 c067a89c 1d80: 00000000 00000000 00000000 c4310468 00000000 c4759380 c4310000 c4310468 1da0: c4310470 c0643258 c4759380 00000000 00000000 c0c4ee24 00000000 c44cc810 1dc0: 00000000 c0c4ee24 00000000 c44cc810 00000000 0347d2a8 e0851e00 e0851e00 1de0: c4759380 c067ad20 c4310000 00000000 c44cc810 c27f8718 c44cc854 c067adb8 1e00: c4933000 00000002 00000001 00000000 00000000 c2130850 00000000 c2130854 1e20: c25fc488 00000000 c0ff162c 00000000 00000001 00000002 00000000 00000000 1e40: c43102c0 c43102c0 00000000 0347d2a8 c44cc810 c44cc814 c2133da8 c06d1a60 1e60: 00000000 00000000 00079028 c2012f24 fee1dead c4933000 00000058 c01431e4 1e80: 01234567 c0143a20 00000000 00000000 00000000 00000000 00000000 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1f80: 00000000 00000000 00000000 0347d2a8 00000002 00000004 00000078 00000058 1fa0: c010028c c0100060 00000002 00000004 fee1dead 28121969 01234567 00079028 1fc0: 00000002 00000004 00000078 00000058 0002fdc5 00000000 00000000 00090acc 1fe0: 00000058 becc9c64 b6e97e05 b6e0e5f6 600e0030 fee1dead 00000000 00000000 msm_atomic_commit_tail from commit_tail+0x9c/0x188 commit_tail from drm_atomic_helper_commit+0x160/0x188 drm_atomic_helper_commit from drm_atomic_commit+0xac/0xe0 drm_atomic_commit from drm_atomic_helper_disable_all+0x1b0/0x1c0 drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x88/0x140 drm_atomic_helper_shutdown from device_shutdown+0x16c/0x240 device_shutdown from kernel_restart+0x38/0x90 kernel_restart from __do_sys_reboot+0x ---truncated---2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed bug on error when unloading amdgpu Fixed bug on error when unloading amdgpu. The error message is as follows: [ 377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278! [ 377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G IOE 6.0.0-thomas #1 [ 377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021 [ 377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy] [ 377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53 [ 377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287 [ 377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000 [ 377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70 [ 377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001 [ 377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70 [ 377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70 [ 377.706325] FS: 00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000 [ 377.706334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0 [ 377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 377.706361] Call Trace: [ 377.706365] <TASK> [ 377.706369] drm_buddy_free_list+0x2a/0x60 [drm_buddy] [ 377.706376] amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu] [ 377.706572] amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu] [ 377.706650] amdgpu_bo_fini+0x22/0x90 [amdgpu] [ 377.706727] gmc_v11_0_sw_fini+0x26/0x30 [amdgpu] [ 377.706821] amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu] [ 377.706897] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] [ 377.706975] drm_dev_release+0x20/0x40 [drm] [ 377.707006] release_nodes+0x35/0xb0 [ 377.707014] devres_release_all+0x8b/0xc0 [ 377.707020] device_unbind_cleanup+0xe/0x70 [ 377.707027] device_release_driver_internal+0xee/0x160 [ 377.707033] driver_detach+0x44/0x90 [ 377.707039] bus_remove_driver+0x55/0xe0 [ 377.707045] pci_unregister_driver+0x3b/0x90 [ 377.707052] amdgpu_exit+0x11/0x6c [amdgpu] [ 377.707194] __x64_sys_delete_module+0x142/0x2b0 [ 377.707201] ? fpregs_assert_state_consistent+0x22/0x50 [ 377.707208] ? exit_to_user_mode_prepare+0x3e/0x190 [ 377.707215] do_syscall_64+0x38/0x90 [ 377.707221] entry_SYSCALL_64_after_hwframe+0x63/0xcd2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential context UAFs gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer. [tursulin: Stable and fixes tags add/tidy.] (cherry picked from commit bed4b455cf5374e68879be56971c1da563bcd90c)2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: add hash if ready poll request can't complete inline If we don't, then we may lose access to it completely, leading to a request leak. This will eventually stall the ring exit process as well.2024-08-21not yet calculated

 
OpenText™ --  CX-E Voice

 
Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files on the system.2024-08-22not yet calculated
 
Atlassian--Bamboo Data Center
 
This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689  was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17 Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Bug Bounty program.2024-08-20not yet calculated

 
Atlassian -- Confluence Data Center

 
This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser and force a end user to execute unwanted actions on a web application in which they're currently authenticated which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.26 * Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.14 * Confluence Data Center and Server 9.0: Upgrade to a release greater than or equal to 9.0.1 See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives). This vulnerability was reported via our Bug Bounty program.2024-08-21not yet calculated

 
Joomla! Project -- Joomla! CMS


 
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..2024-08-20not yet calculated
 
Joomla! Project -- Joomla! CMS

 
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.2024-08-20not yet calculated
 
Checkmk GmbH--Checkmk
 
Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL) allows local users to escalate privileges.2024-08-20not yet calculated
 
N/A -- N/A

 
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability could lead to complete account takeover.2024-08-20not yet calculated
 
N/A -- N/A

 
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.2024-08-23not yet calculated

 
N/A -- N/A

 
A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.2024-08-23not yet calculated

 
BlackBerry -- CylanceOPTICS for Windows

 
A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentially uninstall CylanceOPTICS from a system thereby leaving it with only the protection of CylancePROTECT.2024-08-20not yet calculated
 
N/A -- N/A

 
cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs.2024-08-22not yet calculated

 
N/A -- N/A

 
A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.2024-08-23not yet calculated
 
N/A -- N/A

 
An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.2024-08-21not yet calculated

 
Versa -- Direector

 
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The "Change Favicon" (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Severity: HIGH Exploitation Status: Versa Networks is aware of one confirmed customer reported instance where this vulnerability was exploited because the Firewall guidelines which were published in 2015 & 2017 were not implemented by that customer. This non-implementation resulted in the bad actor being able to exploit this vulnerability without using the GUI. In our testing (not exhaustive, as not all numerical versions of major browsers were tested) the malicious file does not get executed on the client. There are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date.2024-08-22not yet calculated



 
N/A -- N/A

 
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.2024-08-23not yet calculated

 
Joomla! Project--Joomla! CMS

 
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.2024-08-20not yet calculated
 
SonicWall -- SonicOS

 
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.2024-08-23not yet calculated
 
N/A -- N/A

 
Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user credentials or execute actions such as injecting malicious scripts or redirecting users to malicious sites.2024-08-21not yet calculated

 
N/A -- N/A

 
Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.2024-08-23not yet calculated

 
N/A -- N/A

 
Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.2024-08-22not yet calculated

 
N/A -- N/A

 
A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.2024-08-21not yet calculated
 
n/a--n/a
 
A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.2024-08-20not yet calculated
 
N/A -- N/A

 
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.2024-08-22not yet calculated

 
n/a--n/a
 
An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.2024-08-20not yet calculated

 
N/A -- N/A

 
An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page2024-08-23not yet calculated
 
N/A -- N/A

 
Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php.2024-08-23not yet calculated

 
N/A -- N/A

 
An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.2024-08-22not yet calculated

 
n/a--n/a
 
In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.2024-08-19not yet calculated

 
N/A -- N/A

 
An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.2024-08-23not yet calculated


 
N/A -- N/A

 
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords.2024-08-23not yet calculated

 
itsourcecode -- Online Accreditation Management System

 
itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a crafted payload to the SCHOOLNAME, EMAILADDRES, CONTACTNO, COMPANYNAME and COMPANYCONTACTNO parameters in controller.php.2024-08-23not yet calculated

 
N/A -- N/A

 
eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.2024-08-20not yet calculated
 
n/a--n/a
 
cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.2024-08-20not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip packets arrive.2024-08-20not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex The carrier_lock spinlock protects the carrier detection. While it is held, framer_get_status() is called which in turn takes a mutex. This is not correct and can lead to a deadlock. A run with PROVE_LOCKING enabled detected the issue: [ BUG: Invalid wait context ] ... c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78 other info that might help us debug this: context-{4:4} 2 locks held by ifconfig/146: #0: c0926a38 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x12c/0x664 #1: c2006a40 (&qmc_hdlc->carrier_lock){....}-{2:2}, at: qmc_hdlc_framer_set_carrier+0x30/0x98 Avoid the spinlock usage and convert carrier_lock to a mutex.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock.2024-08-21not yet calculated




 
Linux -- Linux
 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates a new modify header to replace the old one when updating CT entry. But if failed to allocate a new one, eg. exceed the max number firmware can support, modify header will be an error pointer that will trigger a panic when deallocating it. And the old modify header point is copied to old attr. When the old attr is freed, the old modify header is lost. Fix it by restoring the old attr to attr when failed to allocate a new modify header context. So when the CT entry is freed, the right modify header context will be freed. And the panic of accessing error pointer is also fixed.2024-08-21not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in load_fpu_state() With the recent rewrite of the fpu code exception handling for the lfpc instruction within load_fpu_state() was erroneously removed. Add it again to prevent that loading invalid floating point register values cause an unhandled specification exception.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health in shutdown callback There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access. Hence, drain health WQ on shutdown callback.2024-08-21not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)2024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: riscv/purgatory: align riscv_kernel_entry When alignment handling is delegated to the kernel, everything must be word-aligned in purgatory, since the trap handler is then set to the kexec one. Without the alignment, hitting the exception would ultimately crash. On other occasions, the kernel's handler would take care of exceptions. This has been tested on a JH7110 SoC with oreboot and its SBI delegating unaligned access exceptions and the kernel configured to handle them.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, this can potentially result in a leaked event, such as in the following scenario that doesn't even require a weak IRQ work implementation to trigger: schedule() prepare_task_switch() =======> <NMI> perf_event_overflow() event->pending_sigtrap = ... irq_work_queue(&event->pending_irq) <======= </NMI> perf_event_task_sched_out() event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) task_work_add(&event->pending_task) finish_lock_switch() =======> <IRQ> perf_pending_irq() //do nothing, rely on pending task work <======= </IRQ> begin_new_exec() perf_event_exit_task() perf_event_exit_event() // If is child event free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // event is leaked Similar scenarios can also happen with perf_event_remove_on_exec() or simply against concurrent perf_event_release(). Fix this with synchonizing against the possibly remaining pending task work while freeing the event, just like is done with remaining pending IRQ work. This means that the pending task callback neither need nor should hold a reference to the event, preventing it from ever beeing freed.2024-08-21not yet calculated




 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.2024-08-21not yet calculated




 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed by using devres_release() instead of devres_destroy() within devm_free_percpu().2024-08-21not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler currently. This may cause the CPU core staying in interrupt context too long and lead to soft lockup under heavy load. Handle CEQEs in BH workqueue and set an upper limit for the number of CEQE handled by a single call of work handler.2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this). To fix: - initialize seqpacket_allow after allocation - set it unconditionally in set_features2024-08-21not yet calculated




 
Linux -- Linux
 
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked Fix a null pointer dereference induced by DEBUG_TEST_DRIVER_REMOVE. Return from __sev_snp_shutdown_locked() if the psp_device or the sev_device structs are not initialized. Without the fix, the driver will produce the following splat: ccp 0000:55:00.5: enabling device (0000 -> 0002) ccp 0000:55:00.5: sev enabled ccp 0000:55:00.5: psp enabled BUG: kernel NULL pointer dereference, address: 00000000000000f0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI CPU: 262 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1+ #29 RIP: 0010:__sev_snp_shutdown_locked+0x2e/0x150 Code: 00 55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 10 41 89 f7 49 89 fe 65 48 8b 04 25 28 00 00 00 48 89 45 d8 48 8b 05 6a 5a 7f 06 <4c> 8b a0 f0 00 00 00 41 0f b6 9c 24 a2 00 00 00 48 83 fb 02 0f 83 RSP: 0018:ffffb2ea4014b7b8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff9e4acd2e0a28 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb2ea4014b808 RBP: ffffb2ea4014b7e8 R08: 0000000000000106 R09: 000000000003d9c0 R10: 0000000000000001 R11: ffffffffa39ff070 R12: ffff9e49d40590c8 R13: 0000000000000000 R14: ffffb2ea4014b808 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9e58b1e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000f0 CR3: 0000000418a3e001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x6f/0xb0 ? __die+0xcc/0xf0 ? page_fault_oops+0x330/0x3a0 ? save_trace+0x2a5/0x360 ? do_user_addr_fault+0x583/0x630 ? exc_page_fault+0x81/0x120 ? asm_exc_page_fault+0x2b/0x30 ? __sev_snp_shutdown_locked+0x2e/0x150 __sev_firmware_shutdown+0x349/0x5b0 ? pm_runtime_barrier+0x66/0xe0 sev_dev_destroy+0x34/0xb0 psp_dev_destroy+0x27/0x60 sp_destroy+0x39/0x90 sp_pci_remove+0x22/0x60 pci_device_remove+0x4e/0x110 really_probe+0x271/0x4e0 __driver_probe_device+0x8f/0x160 driver_probe_device+0x24/0x120 __driver_attach+0xc7/0x280 ? driver_attach+0x30/0x30 bus_for_each_dev+0x10d/0x130 driver_attach+0x22/0x30 bus_add_driver+0x171/0x2b0 ? unaccepted_memory_init_kdump+0x20/0x20 driver_register+0x67/0x100 __pci_register_driver+0x83/0x90 sp_pci_init+0x22/0x30 sp_mod_init+0x13/0x30 do_one_initcall+0xb8/0x290 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ? stack_depot_save_flags+0x21e/0x6a0 ? local_clock+0x1c/0x60 ? stack_depot_save_flags+0x21e/0x6a0 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ? __lock_acquire+0xd90/0xe30 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ? __create_object+0x66/0x100 ? local_clock+0x1c/0x60 ? __create_object+0x66/0x100 ? parameq+0x1b/0x90 ? parse_one+0x6d/0x1d0 ? parse_args+0xd7/0x1f0 ? do_initcall_level+0x180/0x180 do_initcall_level+0xb0/0x180 do_initcalls+0x60/0xa0 ? kernel_init+0x1f/0x1d0 do_basic_setup+0x41/0x50 kernel_init_freeable+0x1ac/0x230 ? rest_init+0x1f0/0x1f0 kernel_init+0x1f/0x1d0 ? rest_init+0x1f0/0x1f0 ret_from_fork+0x3d/0x50 ? rest_init+0x1f0/0x1f0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: CR2: 00000000000000f0 ---[ end trace 0000000000000000 ]--- RIP: 0010:__sev_snp_shutdown_locked+0x2e/0x150 Code: 00 55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 10 41 89 f7 49 89 fe 65 48 8b 04 25 28 00 00 00 48 89 45 d8 48 8b 05 6a 5a 7f 06 <4c> 8b a0 f0 00 00 00 41 0f b6 9c 24 a2 00 00 00 48 83 fb 02 0f 83 RSP: 0018:ffffb2ea4014b7b8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff9e4acd2e0a28 RCX: 0000000000000000 RDX: 0000000 ---truncated---2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpci_scan_bus() Smatch complains about inconsistent NULL checking in vpci_scan_bus(): drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021) Instead of printing an error message and then crashing we should return an error code and clean up. Also the NULL check is reversed so it prints an error for success instead of failure.2024-08-21not yet calculated




 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() Avoid large backtrace, it is sufficient to warn the user that there has been a link problem. Either the link has failed and the system is in need of maintenance, or the link continues to work and user has been informed. The message from the warning can be looked up in the sources. This makes an actual link issue less verbose. First of all, this controller has a limitation in that the controller driver has to assist the hardware with transition to L1 link state by writing L1IATN to PMCTRL register, the L1 and L0 link state switching is not fully automatic on this controller. In case of an ASMedia ASM1062 PCIe SATA controller which does not support ASPM, on entry to suspend or during platform pm_test, the SATA controller enters D3hot state and the link enters L1 state. If the SATA controller wakes up before rcar_pcie_wakeup() was called and returns to D0, the link returns to L0 before the controller driver even started its transition to L1 link state. At this point, the SATA controller did send an PM_ENTER_L1 DLLP to the PCIe controller and the PCIe controller received it, and the PCIe controller did set PMSR PMEL1RX bit. Once rcar_pcie_wakeup() is called, if the link is already back in L0 state and PMEL1RX bit is set, the controller driver has no way to determine if it should perform the link transition to L1 state, or treat the link as if it is in L0 state. Currently the driver attempts to perform the transition to L1 link state unconditionally, which in this specific case fails with a PMSR L1FAEG poll timeout, however the link still works as it is already back in L0 state. Reduce this warning verbosity. In case the link is really broken, the rcar_pcie_config_access() would fail, otherwise it will succeed and any system with this controller and ASM1062 can suspend without generating a backtrace.2024-08-21not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE.2024-08-21not yet calculated



 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: [ 52.987278] eth1: renamed from veth11 [ 53.078814] eth1: renamed from veth21 [ 53.181355] eth1: renamed from veth31 [ 54.921702] ================================================================== [ 54.922602] BUG: KASAN: wild-memory-access in xfrmi_rcv_cb+0x2d/0x295 [ 54.923393] Read of size 8 at addr 6b6b6b6b00000000 by task ping/512 [ 54.924169] [ 54.924386] CPU: 0 PID: 512 Comm: ping Not tainted 6.9.0-08574-gcd29a4313a1b #25 [ 54.925290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.926401] Call Trace: [ 54.926731] <IRQ> [ 54.927009] dump_stack_lvl+0x2a/0x3b [ 54.927478] kasan_report+0x84/0xa6 [ 54.927930] ? xfrmi_rcv_cb+0x2d/0x295 [ 54.928410] xfrmi_rcv_cb+0x2d/0x295 [ 54.928872] ? xfrm4_rcv_cb+0x3d/0x5e [ 54.929354] xfrm4_rcv_cb+0x46/0x5e [ 54.929804] xfrm_rcv_cb+0x7e/0xa1 [ 54.930240] xfrm_input+0x1b3a/0x1b96 [ 54.930715] ? xfrm_offload+0x41/0x41 [ 54.931182] ? raw_rcv+0x292/0x292 [ 54.931617] ? nf_conntrack_confirm+0xa2/0xa2 [ 54.932158] ? skb_sec_path+0xd/0x3f [ 54.932610] ? xfrmi_input+0x90/0xce [ 54.933066] xfrm4_esp_rcv+0x33/0x54 [ 54.933521] ip_protocol_deliver_rcu+0xd7/0x1b2 [ 54.934089] ip_local_deliver_finish+0x110/0x120 [ 54.934659] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 [ 54.935248] NF_HOOK.constprop.0+0xf8/0x138 [ 54.935767] ? ip_sublist_rcv_finish+0x68/0x68 [ 54.936317] ? secure_tcpv6_ts_off+0x23/0x168 [ 54.936859] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 [ 54.937454] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d [ 54.938135] NF_HOOK.constprop.0+0xf8/0x138 [ 54.938663] ? ip_sublist_rcv_finish+0x68/0x68 [ 54.939220] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d [ 54.939904] ? ip_local_deliver_finish+0x120/0x120 [ 54.940497] __netif_receive_skb_one_core+0xc9/0x107 [ 54.941121] ? __netif_receive_skb_list_core+0x1c2/0x1c2 [ 54.941771] ? blk_mq_start_stopped_hw_queues+0xc7/0xf9 [ 54.942413] ? blk_mq_start_stopped_hw_queue+0x38/0x38 [ 54.943044] ? virtqueue_get_buf_ctx+0x295/0x46b [ 54.943618] process_backlog+0xb3/0x187 [ 54.944102] __napi_poll.constprop.0+0x57/0x1a7 [ 54.944669] net_rx_action+0x1cb/0x380 [ 54.945150] ? __napi_poll.constprop.0+0x1a7/0x1a7 [ 54.945744] ? vring_new_virtqueue+0x17a/0x17a [ 54.946300] ? note_interrupt+0x2cd/0x367 [ 54.946805] handle_softirqs+0x13c/0x2c9 [ 54.947300] do_softirq+0x5f/0x7d [ 54.947727] </IRQ> [ 54.948014] <TASK> [ 54.948300] __local_bh_enable_ip+0x48/0x62 [ 54.948832] __neigh_event_send+0x3fd/0x4ca [ 54.949361] neigh_resolve_output+0x1e/0x210 [ 54.949896] ip_finish_output2+0x4bf/0x4f0 [ 54.950410] ? __ip_finish_output+0x171/0x1b8 [ 54.950956] ip_send_skb+0x25/0x57 [ 54.951390] raw_sendmsg+0xf95/0x10c0 [ 54.951850] ? check_new_pages+0x45/0x71 [ 54.952343] ? raw_hash_sk+0x21b/0x21b [ 54.952815] ? kernel_init_pages+0x42/0x51 [ 54.953337] ? prep_new_page+0x44/0x51 [ 54.953811] ? get_page_from_freelist+0x72b/0x915 [ 54.954390] ? signal_pending_state+0x77/0x77 [ 54.954936] ? preempt_count_sub+0x14/0xb3 [ 54.955450] ? __might_resched+0x8a/0x240 [ 54.955951] ? __might_sleep+0x25/0xa0 [ 54.956424] ? first_zones_zonelist+0x2c/0x43 [ 54.956977] ? __rcu_read_lock+0x2d/0x3a [ 54.957476] ? __pte_offset_map+0x32/0xa4 [ 54.957980] ? __might_resched+0x8a/0x240 [ 54.958483] ? __might_sleep+0x25/0xa0 [ 54.958963] ? inet_send_prepare+0x54/0x54 [ 54.959478] ? sock_sendmsg_nosec+0x42/0x6c [ 54.960000] sock_sendmsg_nosec+0x42/0x6c [ 54.960502] __sys_sendto+0x15d/0x1cc [ 54.960966] ? __x64_sys_getpeername+0x44/0x44 [ 54.961522] ? __handle_mm_fault+0x679/0xae4 [ 54.962068] ? find_vma+0x6b/0x ---truncated---2024-08-21not yet calculated

 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning: kernel: invalid HE MCS: bw:6, ru:6 kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.2024-08-21not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x3702024-08-21not yet calculated






 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there's a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-12024-08-21not yet calculated


 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod, and when the chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid to root, violating the expressed authorization of "only cdrom group members can setuid to root". Re-check that we still have execute permissions in case the metadata has changed. It would be better to keep a copy from the perm-check time, but until we can do that refactoring, the least-bad option is to do a full inode_permission() call (under inode lock). It is understood that this is safe against dead-locks, but hardly optimal.2024-08-21not yet calculated







 
Linux -- Linux

 
In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.2024-08-23not yet calculated







 
n/a--n/a
 
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear.2024-08-19not yet calculated

 
N/A -- N/A

 
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.2024-08-22not yet calculated




 
N/A -- N/A

 
An issue was discovered in Matrix libolm (aka Olm) through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.2024-08-22not yet calculated



 
N/A -- N/A

 
An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.2024-08-22not yet calculated

 
N/A -- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing.2024-08-24not yet calculated
 
N/A -- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.2024-08-24not yet calculated
 
N/A -- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.2024-08-24not yet calculated
 
-- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow.2024-08-24not yet calculated
 
N/A -- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.2024-08-24not yet calculated
 
N/A -- N/A

 
An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.2024-08-24not yet calculated
 
N/A -- N/A

 
The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)2024-08-24not yet calculated
 
Centreon -- Centreon

 
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateServiceHost function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-23294.2024-08-21not yet calculated
 
Centreon -- Centreon

 
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.2024-08-21not yet calculated
 
GitHub -- GitHub Enterprise Server

 
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access token was not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14 and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.2024-08-20not yet calculated



 
Unknown -- Ditty

 
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.392024-08-23not yet calculated
 
GitHub -- GitHub Enterprise Server

 
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.2024-08-20not yet calculated



 
NETGEAR -- ProSAFE Network Management System

 
NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23207.2024-08-21not yet calculated

 
NETGEAR -- ProSAFE Network Management System

 
NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getFilterString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23399.2024-08-21not yet calculated

 
OpenText™ -- Network Node Manager i (NNMi)

 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allow Cross-Site Scripting (XSS).This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2.2024-08-23not yet calculated
 
OpenText™ -- Network Node Manager i (NNMi)

 
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2.2024-08-23not yet calculated
 
GitHub -- GitHub Enterprise Server

 
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.2024-08-20not yet calculated


 
Foxit -- PDF Reader


 
Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23702.2024-08-21not yet calculated

 
Foxit -- PDF Reader

 
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23736.2024-08-21not yet calculated

 
Foxit -- PDF Reader


 
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23900.2024-08-21not yet calculated

 
Foxit -- PDF Reader

 
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23928.2024-08-21not yet calculated

 
Rockwell Automation -- ThinManager® ThinServer

 
A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junction that points to the target directory.2024-08-23not yet calculated
 
pretix -- pretix

 
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.2024-08-23not yet calculated
 

Please share your thoughts

We recently updated our anonymous product survey ; we’d welcome your feedback.

FREE Application Letter Templates

Express gratitude with finesse using Appreciation Letter Templates from Template.net. Our exclusive collection, offered with precision by Template.net, elevates your appreciation game. Craft heartfelt letters effortlessly with our Ai Editor Tool, ensuring a personalized touch in every message of thanks. From acknowledging achievements to expressing gratitude, our editable and customizable templates set the standard for sincere appreciation. Elevate your expressions of thanks with professionally designed te

Emergency Vacation Letter Template

Emergency Vacation Letter Template

Sample Application Letter  Template

Sample Application Letter Template

Application Letter Sample for Any Position Template

Application Letter Sample for Any Position Template

Short Application Letter For Any Position Template

Short Application Letter For Any Position Template

Application Letter Template For Any Position

Application Letter Template For Any Position

Relocation Application Letter Template

Relocation Application Letter Template

Healthcare Application Letter Template

Healthcare Application Letter Template

Entry-Level Application Letter Template

Entry-Level Application Letter Template

University Vacation Letter Template

University Vacation Letter Template

Community Support Letter Template

Community Support Letter Template

Wedding Sponsorship Letter Template

Wedding Sponsorship Letter Template

Support Application Letter Template

Support Application Letter Template

Scholarship Grant Application Letter Template

Scholarship Grant Application Letter Template

Rent Increase Letter to Tenant Template

Rent Increase Letter to Tenant Template

Short Application Letter  Template

Short Application Letter Template

Application Letter for Student  Template

Application Letter for Student Template

Teacher Application Letter  Template

Teacher Application Letter Template

Application Letter for College  Template

Application Letter for College Template

Application Letter for Vacancy  Template

Application Letter for Vacancy Template

Nurse Application Letter  Template

Nurse Application Letter Template

Employment Application Letter  Template

Employment Application Letter Template

Application Letter to Government  Template

Application Letter to Government Template

Application Letter to University  Template

Application Letter to University Template

Appplication Letter for Bank  Template

Appplication Letter for Bank Template

Application Letter for College Admission  Template

Application Letter for College Admission Template

Application Letter for Doctor  Template

Application Letter for Doctor Template

Application Letter for Leave  Template

Application Letter for Leave Template

Application Letter for Fellowship  Template

Application Letter for Fellowship Template

Simple Application Letter  Template

Simple Application Letter Template

Application Letter for Fire Officer  Template

Application Letter for Fire Officer Template

Application Letter for Assistant Professor  Template

Application Letter for Assistant Professor Template

Application Letter for Job Vacancy  Template

Application Letter for Job Vacancy Template

Application Letter for Graphic Designer Template

Application Letter for Graphic Designer Template

Application Letter for Financial Assistance Template

Application Letter for Financial Assistance Template

Application Letter for Engineering Job Template

Application Letter for Engineering Job Template

Application Letter for Principal Template

Application Letter for Principal Template

Application Letter for Dentist Job Template

Application Letter for Dentist Job Template

Application Letter for Company Manager Template

Application Letter for Company Manager Template

Application Letter for Bank Job Template

Application Letter for Bank Job Template

Application Letter for Teaching Job Template

Application Letter for Teaching Job Template

Application Letter to HR Template

Application Letter to HR Template

Application Letter for Scholarship Template

Application Letter for Scholarship Template

Job Application Letter Template

Job Application Letter Template

Application Letter for Business Template

Application Letter for Business Template

Application Letter for Vacant Position Template

Application Letter for Vacant Position Template

Resume Application Letter Template

Resume Application Letter Template

Application Letter for Fresh Graduate Template

Application Letter for Fresh Graduate Template

Application Letter to a Company Template

Application Letter to a Company Template

Application Letter for Employment Template

Application Letter for Employment Template

Formal Application Letter Template

Formal Application Letter Template

  • Application Cover Letter
  • Application Form
  • Application Letter
  • Letter Design
  • Letter Examples
  • Letter of Intent to Purchase
  • Letter of Interest
  • Letter of Recommendation for Graduate School
  • Letter of Intent
  • Business Letter of Intent
  • Complaint Letter to Landlord
  • Job Application Letter for Teacher
  • Request Letter for Approval
  • Request Letter to Principal
  • Absence Letter
  • Academic Letter
  • Acceptance Letter
  • Accountant Letter
  • Acknowledgement Letter
  • Acquisition Letter
  • Admission Letter
  • Apartment Letter
  • Apology Letter
  • Appeal Letter
  • Appointment Letter
  • Appointment Request Letter
  • Appraisal Letter
  • Appreciation Letter
  • Approval Letter
  • Assurance Letter
  • Attendance Warning Letter
  • Auditor Letter
  • Authorization Letter
  • Award Letter
  • Bank Letter
  • Behavior Warning Letter
  • Billing Letter
  • Board Letter
  • Board Resignation Letter
  • Bonus Letter
  • Business Introduction Letter
  • Business Letter
  • Business Meeting Letter
  • Business Partnership Letter
  • Business Proposal Letter
  • Business Relationship Letter
  • Campaign Letter
  • Cancellation Letter
  • Catering Letter
  • Catering Proposal Letter
  • Character Letter
  • Character Reference Letter
  • Church Letter
  • Church Resignation Letter
  • Claim Letter
  • Client Letter
  • Coach Letter
  • Colleague Recommendation Letter
  • Collection Letter
  • College Letter
  • Communications Letter
  • Community Letter
  • Community Service Letter
  • Company Introduction Letter
  • Company Letter
  • Complaint Letter
  • Confirmation Letter
  • Congratulation Letter
  • Construction Letter
  • Consultant Letter
  • Contractor Letter
  • Corporate Sponsorship Letter
  • Coworker Recommendation Letter
  • Credit Letter
  • Customer Complaint Letter
  • Customer Service Letter
  • Daycare Termination Letter
  • Demand Letter
  • Director Letter
  • Disciplinary Letter
  • Doctor Appointment Letter
  • Doctor Letter
  • Donation Letter
  • Employee Appointment Letter
  • Employee Complaint Letter
  • Employee Letter
  • Employee Reference Letter
  • Employee Resignation Letter
  • Employee Termination Letter
  • Employee Transfer Letter
  • Employment Letter
  • Employment Verification Letter
  • Environment Complaint Letter
  • Equipment Letter
  • Event letter
  • Event Proposal Letter
  • Eviction Letter
  • Excuse Letter
  • Experience Letter
  • Final Warning Letter
  • Financial Letter
  • First Warning Letter
  • Follow Up Letter
  • Food Letter
  • Formal Complaint Letter
  • Formal Letter
  • Formal Resignation Letter
  • Freelance Letter
  • Freelancer Letter
  • Friendly Letter
  • Fundraising Letter
  • Gift letter
  • Government Letter
  • Grant Letter
  • Guarantee Letter
  • Hardship Letter
  • Health Letter
  • Hotel Letter
  • Immediate Resignation Letter
  • Immigration Letter
  • Income Letter
  • Informal Letter
  • Information Letter
  • Inquiry Letter
  • Insurance Letter
  • Intent Letter
  • Internal Letter
  • Internship Acceptance Letter
  • Internship Letter
  • Internship Offer Letter
  • Internship Reference Letter
  • Interview Letter
  • Introduction Letter
  • Job Acceptance Letter
  • Job Application Letter
  • Job Appointment Letter
  • Job Experience Letter
  • Job Offer Letter
  • Job Reference Letter
  • Job Resignation Letter
  • Landlord Letter
  • Landlord Reference Letter
  • Late Warning Letter
  • Lease Letter
  • Lease Renewal Letter
  • Leave Letter
  • Loan Application Letter
  • Loan Letter
  • Marketing Letter
  • Medical Leave Letter
  • Medical Letter
  • Medical School Letter
  • Medical Thank You Letter
  • Meeting Letter
  • Membership Letter
  • Motivation Letter
  • Negotiation Letter
  • Nursing Letter
  • Offer Letter
  • Ownership Transfer Letter
  • Partnership Letter
  • Patient Termination Letter
  • Payment Letter
  • Payment Reminder Letter
  • Performance letter
  • Performance Warning Letter
  • Permission Letter
  • Personal Letter
  • Personal Reference Letter
  • Principal Letter
  • Printable Letter
  • Professional Letter
  • Project Letter
  • Promotion Letter
  • Property Letter
  • Purchase Letter
  • Purchase Order Letter
  • Query Letter
  • Real Estate Letter
  • Rebuttal Letter
  • Recommendation Letter
  • Refusal Letter
  • Rejection Letter
  • Relieving Letter
  • Reminder Letter
  • Renewal Letter
  • Rental Letter
  • Representative Letter
  • Request Letter
  • Requisition Letter
  • Reschedule Letter
  • Resignation Acceptance Letter
  • Resignation Letter
  • Restaurant Letter
  • Retirement Letter
  • Safety Letter
  • Salary Letter
  • Sales Letter
  • Scholarship Application Letter
  • Scholarship Letter
  • School Letter
  • School Recommendation Letter
  • Security Letter
  • Service Complaint Letter
  • Service Letter
  • Service Recommendation Letter
  • Solicitation Letter
  • Sponsorship Letter
  • Sports Sponsorship Letter
  • Student Letter
  • Student Reference Letter
  • Support Letter
  • Teacher Letter
  • Teacher Recommendation Letter
  • Tenant Warning Letter
  • Thank You Letter
  • Training Letter
  • Training Proposal Letter
  • Transfer Letter
  • Transfer Request Letter
  • Travel Letter
  • Truck Driver Letter
  • Two Weeks Notice Letter
  • University Letter
  • Vacation Leave Letter
  • Vacation Letter
  • Verbal Warning Letter
  • Verification Letter
  • Volunteer Letter
  • Waiver Letter
  • Warning Letter
  • Welcome Letter
  • Work Experience Letter
  • Work From Home Letter
  • Work From Home Request Letter

Free Application Letter Template, Printable, Download or Share via Email

Whether you’re a student looking for an intern job, a fresh graduate, teacher, or professional, make sure you have an excellent job application letter to increase your chances of getting hired. Template.net helps you meet that need with our free printable application letter templates that come with fillable original content. Choose your template sample in a simple or formal layout that you can edit to your specifications using our editor tool. Use your application letter to supplement your cover letter for employment or formal work request. Download our templates for free and print or share via email.

Edit Application Letter Online for Free and Download

Our application letter template examples come with a variety of structures for use in different application requirements including internship and promotion applications. Whether you want to fill a vacant or current position, choose your template sample that’s fully customizable with our editor tool. Choose your application form or job application letter template for a beginner, nurse position, school, university, business, or corporate office positions. Whether writing your application letter for printing or email sending, download your template for free in PDF file format.

Frequently Asked Questions

Is an application letter a formal letter.

Yes, an application letter is a formal letter. People send this letter to their potential employers and tell them that they are interested in a job position.

What are the types of formal letters?

Here are some types of formal letters:

  • Cover Letters
  • Complaint Letters
  • Employee Letters
  • Lease Letters
  • Leave Letters
  • Proposal Letters
  • Marketing Letters
  • Intent Letters
  • Resignation Letters
  • Termination Letters

Why are formal letters important?

Formal letters are essential to businesses and other professional agencies. This is because, through these letters, they can communicate business matters and other professional matters.

What is the purpose of a letter?

A letter's purpose is to send the message of the sender to its recipient. It serves as a communication tool, especially for people who can't meet in person.

How do I apply for a job?

  • Identify the job you're interested in.
  • Search for a company you want to work in.
  • Create a resume and an application letter tailored for the job.
  • Research about the company's hiring process.
  • Apply for it.

Get Access to World's largest Template Library & Tools

  • Access to 1 Million+ Templates & Tools
  • Unlimited access to Design & Documents AI editors
  • Professionally Made Content and Beautifully Designed
  • Instant Download & 100% Customizable

IMAGES

  1. General Application Cover Letter PDF Template Free Download

    job application letter sample pdf free download

  2. 8+ Best Job Application Letter Templates & Samples

    job application letter sample pdf free download

  3. An Example Of A Job Application Letter

    job application letter sample pdf free download

  4. 49 Best Letter Of Application Samples (+"How to Write" Guide) ᐅ

    job application letter sample pdf free download

  5. Sample Job Application Letter

    job application letter sample pdf free download

  6. Application Letter Templates

    job application letter sample pdf free download

VIDEO

  1. How to write job application letter#shorts

  2. How to write job application letter

  3. JOB APPLICATION LETTER (sample)

  4. An application for the Manager

  5. How To Write Job Application Letter-Job Application In English

  6. How to write job application letter #shorts

COMMENTS

  1. 53+ Job Application Letters in PDF

    29+ Job Offer Letter Examples. 47+ Resignation Letter Templates - Free Word, Excel, PDF, iPages. 19+ Sample Job Application Letters for Assistants - DOC, PDF. 14+ Job Application Letters For HR. 21+ Letter of Recommendation for Student - PDF, DOC. 11+ Part-Time Job Cover Letter Templates -Samples, Examples.

  2. Simple Cover Letter Templates [Word & PDF] Download for free

    With an application letter or resume, there's no need to over-complicate the process - it's all about writing a letter that gets you hired! Free simple cover letter template - download as PDF or Word file. At Resume.io, our mission is to help you land the job you're after without wasting precious time and energy. That's why we offer ...

  3. Application Letter Templates in PDF

    An application letter is a formal document that expresses an interest coming from the writer. Whether a person applies for loans, scholarships, employment (the letter usually comes with creative resumes), job positions, or promotions. It should contain the necessary information of the writer to warrant a reply.

  4. Job Application Letter Templates in PDF

    4. Be Courteous and Keep it Simple. Your job application is a formal letter, not a love letter, a poem, or a birthday letter. Hence, it should be free from informal words. When writing it, you should adopt a professional tone with words of courtesy. All of our letter templates follow this approach.

  5. Free Downloadable Cover Letter Templates (Word & Google Docs)

    Each basic template is free to download (compatible with Microsoft Word and Google Docs), and will help you create the perfect cover letter for whatever job you apply for. The Classic. "The Classic" cover letter template is clean, traditional, and the perfect format to start off your application. Chicago.

  6. FREE 31+ Sample Application Letter Sample & Templates in PDF, MS Word

    PDF; Size: 580 KB. Download Procedure to Write an Application Letter. Writing an application letter, often known as a cover letter, is a crucial step in the Job Application Process.This letter accompanies your resume and is your first opportunity to introduce yourself to a potential employer.

  7. PDF WRITING AN APPLICATION LETTER

    The letter of application is essentially a sales letter. In it, you are trying to sell your services and, in most cases, you will be competing with other applicants. Your immediate objective is to have your letter read by someone in the organization who has authority to screen job applicants; your ultimate goal is to obtain an interview.

  8. Modern Cover Letter Templates [Word & PDF] Download for free

    Check out our free cover letter samples for inspiration. Use these examples and our cover letter builder to create a beautiful cover letter in minutes. Our new and advanced Builder will guide you from start to finish. Save time with our easy 3-step resume builder. No more writer's block or formatting difficulties in Word.

  9. Application Letter Examples

    Social Work Cover Letter. Job Application Emails. Simple Application Letter. APA Cover Letter. Fresh Graduate Cover Letter. Resume Cover Letter. RN (Registered Nurse) Cover Letter. Address Email Cover Letter. High School Scholarship Application.

  10. Official Job Application Letter

    Sample Job Application Letter with Format (for fresh-graduate applicants) July 4, 2018 (date to be listed should be when the application letter will be submitted) (standard format - phone number, home address, email address of applicant) (standard format - name of HR manager or other company officer, name of company, company address ...

  11. Job Application Letter

    The name of the person to whom the job application letter is for and his or her connection to the company. The business name and other information of the company where you are applying. A salutation. An introduction that you can wrap up in the first paragraph of your job application letter, which includes; Your name.

  12. 55+ Cover Letter Templates in Docx & Pdf

    Free Cover Letter Templates. These cover letters have been made with the, absolutely free, cover letter tool (AI-assisted) from Resume.io. Here you can download the Pdf- & JPEG files, but with the tool, also in Word format, so you can keep editing them yourself. Create Cover Letter.

  13. Job Application Letter

    Our Job Application Letter Example makes your simple letters personal and professionally written. Whether you prefer handwritten or electronic letters, each Job Application Letter in PDF features prewritten sample content for a request letter, application, references, and more!Explain your intent and boost your simple resumes to be the right candidate for the role.

  14. Sample Cover Letter for Job Application Word (Free Download)

    A well-written cover letter introduces you to potential employers, providing a glimpse into your personality, skills, and qualifications. This template helps you do that and more. Download it now! File format: Word (Microsoft) File size: 79 KB. Ready-to-use: fast, easy, and free. Download: cover letter in Word.

  15. FREE 13+ Application Letter Samples, PDF, MS Word, Google Docs

    Download In. PDF Word Google Docs. The Best Application Letter for Job Vacancy connects your unique achievements and aspirations with the company's goals. Strategically referencing a Job Acceptance Letter can demonstrate your eagerness and history of successful job integrations. You should also take a look at our Authorization Letter.

  16. FREE 19+ Application Letter Templates & Samples Google Docs, Pages

    Download Application Letter Bundle. Application Letter for a Job Vacancy [Your Name] [Your Address] [City, State, Zip Code] [Your Email Address] [Your Phone Number] [Date] [Hiring Manager's Name] [Company Name] [Company Address] [City, State, Zip Code] Dear [Hiring Manager's Name], I am writing to express my keen interest in the [Job Title] position listed on [where you found the job ...

  17. 2024 Application Letter Templates

    Thus, in order to save yourself from trouble, it is necessary that you take a look at application letter sample in order to write a letter smoothly.So, go ahead and start Writing! Fillable and printable Application Letter Templates 2024. Fill, sign and download Application Letter Templates online on Handypdf.com.

  18. 22 Free Job Application Forms (Templates)

    22 Free Job Application Forms (Templates) - Word, PDF. A job application form is a formal document containing company-specific questions that employers use to gather information from job applicants. Employers impose the document on applicants with an aim to get substantial information pertaining to their educational heights, skills, personal ...

  19. 93 Best Application Letter Templates & Samples

    29+ Job Offer Letter Examples. 47+ Resignation Letter Templates - Free Word, Excel, PDF, iPages. 19+ Sample Job Application Letters for Assistants - DOC, PDF. 14+ Job Application Letters For HR. 21+ Letter of Recommendation for Student - PDF, DOC. 11+ Part-Time Job Cover Letter Templates -Samples, Examples.

  20. Free Job Application Form (standard template)

    The Job Applicant, who will submit this application, will need to be identified at the beginning of this process. His or her name is expected in the standard presentation of "First," "Middle," and "Last" where requested. (2) Current Date. (3) Address. The Job Applicant's residential address must be distributed to the next area.

  21. Free Cover Letter Samples

    These cover letter examples are free for use and can be downloaded in PDF and Microsoft Word format. .NET Developer Cover Letter Sample. 3D Artist Cover Letter Sample. Academic Advisor Cover Letter Sample. Account Director Cover Letter Sample. Account Executive Cover Letter Sample. Account Manager Cover Letter Sample.

  22. Application for Parole in Place for Certain Noncitizen Spouses and

    Starting Aug. 19, 2024, you may file Form I-131F, Application for Parole in Place for Certain Noncitizen Spouses and Stepchildren of U.S. Citizens, online with the applicable filing fee. There is no fee waiver available for Form I-131F. ... (PDF, 8.95 MB) Filing Online. How to Create a USCIS Online Account; Tips for Filing Forms Online;

  23. Vulnerability Summary for the Week of August 19, 2024

    presstigers-- Simple Job Board : The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object.

  24. FREE Application Letter Templates & Examples

    Choose your template sample in a simple or formal layout that you can edit to your specifications using our editor tool. Use your application letter to supplement your cover letter for employment or formal work request. Download our templates for free and print or share via email.