Vuldb Updates

A vulnerability marked as problematic has been reported in OpenNDS up to 10.1.1. Affected by this issue is some unknown functionality of the component HTTP GET Handler. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2023-38315. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability classified as critical has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. This vulnerability is documented as CVE-2026-1120. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. This vulnerability is reported as CVE-2026-1121. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. This vulnerability appears as CVE-2026-1122. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as critical has been identified in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Executing a manipulation of the argument activity_id can lead to sql injection. This vulnerability is registered as CVE-2026-1119. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.11.10/6.12.1. The impacted element is the function qcom_pcie_perst_deassert of the component qcom-ep. The manipulation leads to reachable assertion. This vulnerability is documented as CVE-2024-53153. The attack requires being on the local network. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in Linux Kernel up to 6.11.10/6.12.1. The affected element is the function pex_ep_event_pex_rst_deassert of the component tegra194. Executing a manipulation can lead to reachable assertion. This vulnerability is registered as CVE-2024-53152. The attack requires access to the local network. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel up to 5.15.173/6.1.119/6.6.63/6.11.10/6.12.1. It has been rated as problematic. This affects the function xdr_check_write_chunk of the file net/sunrpc/xprtrdma/svc_rdma_recvfrom.c of the component svcrdma. The manipulation leads to integer overflow. This vulnerability is uniquely identified as CVE-2024-53151. The attack can only be initiated within the local network. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel up to 6.12.1. It has been declared as problematic. Affected by this issue is some unknown functionality of the component usb-audio. Executing a manipulation can lead to out-of-bounds read. This vulnerability is handled as CVE-2024-53150. The attack can only be done within the local network. Additionally, an exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.11.10/6.12.1 and classified as critical. Affected is the function start_clu of the component exfat. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2024-53147. Access to the local network is required for this attack to succeed. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.1. It has been classified as critical. Affected by this vulnerability is the function remap_pfn_range of the component comedi. Performing a manipulation results in buffer overflow. This vulnerability is known as CVE-2024-53148. Access to the local network is required for this attack. No exploit is available. Upgrading the affected component is recommended.

A vulnerability classified as problematic has been found in Linux Kernel up to 6.11.10/6.12.1. This affects the function pmic_glink_ucsi_connector_status of the component glink. The manipulation leads to off-by-one. This vulnerability is listed as CVE-2024-53149. The attack must be carried out from within the local network. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability marked as problematic has been reported in Linux Kernel up to 6.12.1. The affected element is an unknown function of the component um. Performing a manipulation results in integer overflow. This vulnerability is identified as CVE-2024-53145. The attack can only be performed from the local network. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability described as problematic has been identified in Linux Kernel up to 6.12.1. The impacted element is the function decode_cb_compound4res of the component NFSD. Executing a manipulation of the argument length can lead to integer overflow. This vulnerability is tracked as CVE-2024-53146. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is recommended.

A vulnerability labeled as critical has been found in Linux Kernel up to 6.13.3/6.14-rc2. This impacts the function cancel_delayed_work_sync. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2025-21797. The attack requires access to the local network. No exploit is available. The affected component should be upgraded.

A vulnerability marked as critical has been reported in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a manipulation of the argument Title results in sql injection. This vulnerability is cataloged as CVE-2026-1118. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. It has been declared as critical. Affected is an unknown function in the library lib/refcount.c. Such manipulation leads to use after free. This vulnerability is listed as CVE-2025-21796. The attack must be carried out from within the local network. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 6.6.78/6.12.15/6.13.3/6.14-rc1/6.14-rc2. The impacted element is the function usb_check_int_endpoints of the file usb.c. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2025-21794. The attack must be carried out from within the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. This affects the function nfsd4_shutdown_callback. Performing a manipulation results in state issue. This vulnerability is cataloged as CVE-2025-21795. The attack must originate from the local network. There is no exploit available. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. The impacted element is the function vxlan_vnigroup_init. This manipulation causes unchecked return value. This vulnerability appears as CVE-2025-21790. The attacker needs to be present on the local network. There is no available exploit. You should upgrade the affected component.