A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability in the Linux kernel related to the HID subsystem and BPF programs was resolved. The issue involved improper casting of a size variable to size_t when checking hardware request results, causing negative error codes to be misinterpreted as large positive values. This led to hardware errors being silently treated as successes, potentially causing BPF programs to operate on uninitialized or stale data. The fix involved casting the size variable to ssize_t to correctly handle negative error codes.
A deadlock vulnerability in the Linux kernel scheduler extension (sched_ext) was resolved by changing when ops.dequeue() is invoked relative to DSQ locks. The issue caused self-deadlocks when ops.dequeue() was called while holding a source user DSQ lock, particularly affecting BPF schedulers that lock the source user DSQ during iteration. The fix moves the ops.dequeue() call to after the DSQ unlock to prevent deadlocks and ensures the callback is invoked exactly once.
A vulnerability in the Linux kernel's IP-in-IP Generic Segmentation Offload (GSO) implementation allowed recursive segmentation calls that could exhaust the kernel stack. This was due to unbounded IPv4 and IPv6 IP-in-IP nesting in GSO handlers. The issue has been resolved by limiting recursion depth using the existing IP_TUNNEL_RECURSION_LIMIT, preventing excessive nested calls.
A vulnerability in the Linux kernel's IP Virtual Server (IPVS) component related to unbounded growth of LBLCR and LBLC cache entries has been resolved. The functions ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every new destination address without effectively limiting the cache size, allowing potential resource exhaustion. The fix introduces a limit to reject new cache entries once the cache size reaches 1.5 times the configured max_size, preventing uncontrolled growth while maintaining service availability.
A use-after-free (UAF) vulnerability in the Linux kernel scheduler was addressed by introducing a new pointer task_struct->sched_cache_grp. This change decouples scheduler hot-path accesses from the memory management structure, fixing the UAF issue that occurred when accessing the scheduler cache group through a task whose memory management structure was being switched.
A use-after-free vulnerability in the Linux kernel's audit subsystem was resolved. The flaw occurs in the kill_rules() function when removing mixed AUDIT_DIR and AUDIT_EXE rules, leading to a race condition that can cause a use-after-free of executable marks. This happens when a watched directory is removed concurrently with another task evaluating the rule, potentially freeing memory prematurely. The fix involves unlinking rules from RCU-visible lists and waiting for an RCU grace period before freeing executable marks, preventing the use-after-free condition.
A use-after-free vulnerability in the Linux kernel's fprobe subsystem has been resolved. The issue arises because unregister_fprobe() and unregister_fprobe_async() rely on standard RCU grace periods that do not track execution when RCU is not watching, such as in idle or nohz_full states. This can lead to use-after-free if an fprobe handler runs during these states after unregistration. The fix involves using guard(rcu_sched_notrace) and checking rcu_is_watching() to ensure handlers exit early when RCU is not watching, and reducing lockdep overhead by replacing rcu_read_lock() with rcu_read_lock_sched_notrace() where appropriate.
A SQL injection vulnerability exists in the Exam::startExam function of the exam.php file in the itsmeravitejak Online-Examination-System up to commit e6208e630b14657999bbfe4c9912302d2a1e2449. The vulnerability allows remote attackers to manipulate the 'topicid' argument to execute SQL injection attacks. The project has not yet responded with a fix, and version information for affected or updated releases is unavailable due to the rolling release model. Exploit code is publicly available.
A vulnerability in the Linux kernel's KVM x86 virtualization component was resolved involving the handling of nested state pages. If the retrieval of nested pages fails during the KVM_RUN path, stale and unpinned page frame numbers (PFNs) from a previous nested run could be reused, potentially causing incorrect memory mappings such as the vAPIC page. Both SVM and VMX implementations have safeguards to clear the request on VM-Exit, preventing double-mapping issues.
A use-after-free vulnerability in the Linux kernel's device tree overlay handling was resolved. The issue involved improper ordering when adding properties to a node's deadprops list, leading to a double free of a property pointer if adding the changeset property failed. The fix ensures the property is linked only after the changeset add operation succeeds, preventing double free errors.
A vulnerability in the Linux kernel's dm-pcache component was resolved. The flaw involved the handling of a kset whose on-media size could be forged to exceed the remaining segment space, causing a buffer overrun and triggering a kernel BUG_ON condition. The fix involves rejecting any kset whose on-media size exceeds the remaining segment space before processing.