Vulnerability feed

Executive summary

This advisory describes a resource cleanup bug in the Linux kernel network driver for the TI CPSW Ethernet switch (cpsw_new). When driver probe fails during port registration, a devlink instance was left registered, which the advisory describes as a fix in the stable kernel tree. The advisory does not state a severity rating, and it does not describe any exploitation or required fix action beyond applying the patched kernel.

Technical summary

The flaw is a resource leak in the error path of cpsw_probe() in drivers/net/ethernet/ti/cpsw_new.c. If cpsw_register_ports() fails after cpsw_register_devlink() succeeded, the devlink instance and its parameters remained registered after probe failed. The patch adds a clean_unregister_devlink label that calls cpsw_unregister_devlink() before the existing notifier cleanup. The advisory does not state an attack vector, privileges required, or any impact beyond the leak. Affected and fixed kernel version numbers are not stated in the advisory, and no workaround or detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/0a44945b0d3422f…49c97e293f3e21a8c585

Score

No CVSS score published.

Affects

LinuxTILinuxLinux kernelTI cpsw_new

Executive summary

The TI WooCommerce Wishlist WordPress plugin, before version 2.13.0, has an access control flaw that lets its REST API bypass the owner-only restrictions that the front-end enforces. The advisory rates the issue medium severity with a CVSS score of 5.3, and the fix is included in version 2.13.0.

Technical summary

This is a broken access control flaw (CWE-284) in the REST API of the TI WooCommerce Wishlist plugin, where owner-only restrictions applied on the front-end are not enforced. The advisory text is truncated, so the exact attacker privileges and preconditions are not stated. The affected versions are described as before 2.13.0, and the fixed version is 2.13.0. The advisory does not state a workaround, whether the issue is being exploited in the wild, or any detection guidance. The CVSS score is listed as 5.3 (medium).

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/64e9f028-2124-…00-a5cf-0ed5d4d13e62

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affects

TITI WooCommerce Wishlist