CVE Vulnerability Catalog

In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1 in the Event::loadFromArray function of the queue.php file in the Remote Event Queue Endpoint component. Data manipulation results in deserialization, and the attack can be initiated remotely. Upgrading to version 1.8.2 addresses this issue.

A vulnerability has been found in GibbonEdu Gibbon up to version 30.0.01. The affected element is the makeBlock function in modules/Planner/units_add_blockAjax.php of the Unit Planner component. Manipulation of gibbonUnitBlockID/mode leads to missing authentication. The attack can be carried out remotely. The exploit has been disclosed. Upgrading to version 31.0.00 fixes the issue.

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash.

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as the zimbra user.

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, Imagick's support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution. This has been patched in 16.4.0.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.

IBM Guardium Data Protection 12.2 improperly limits a pathname to a restricted directory, allowing a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.

In kitty versions from 0.40.0 to 0.49.0, there is an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. A program writing to the terminal can send an OSC 66 escape code with a grapheme cluster longer than four codepoints, causing a write past the end of the fixed-size buffer in screen_handle_multicell_command(). This results in termination of the kitty process and all its windows, tabs and child processes.

In kitty versions 0.47.0 to 0.49.0, there is an improper link resolution before file access in the drag source staging path of the drag and drop protocol. A program writing to the terminal can create files and directories outside the staging directory by crafting entries with symlinks and subsequently following them during item creation. This allows the attacker to write to any path writable by the user running kitty.

The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data from imported crawler captures (item IDs, URLs, and screenshot file paths) is interpolated directly into inline JavaScript contexts without escaping. An attacker with a user-role API client can import a malicious capture, and when any user (including privileged ones) views the domain page, the script executes in the victim's browser.

The Onion module in AIL Framework has a performance shortcut in URL extraction that accepts URLs as valid .onion targets based only on a length check (exactly 69 characters) and a suffix check (ending in '.onion'), without proper hostname parsing. An unauthenticated attacker who can publish or control web content crawled by the framework can embed a crafted URL with an IP address or non-onion hostname that satisfies these conditions and gets queued as a legitimate onion crawler task.

The AIL Framework crawler task creation API (api_add_crawler_task) has an insufficient authorization check when a user supplies a cookiejar UUID. The original code only verified that the cookiejar exists and, if its access level was 0, compared the owner user ID to the requesting user ID. It did not validate organizational boundaries or account for the user's role. An authenticated user can reference another organization's cookiejar and have the crawler use that organization's stored cookies when performing web crawls.

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions and rendered into the DOM using D3's html() method in the tooltip, allowing arbitrary JavaScript execution in the analyst's browser when hovering over a timeline entry.