CVE Vulnerability Catalog

In the Linux kernel's netfilter subsystem (nf_conntrack_expect), the timer API for expectations has been replaced with a GC worker approach. This change addresses a race condition where an expectation could access a stale exp->master pointer after it was freed, and introduces the NF_CT_EXPECT_DEAD flag for safe reaping.

In the Linux kernel, the netfilter flowtable module has an underflow of num_encaps when untagging VLAN on a bridge, which can lead to an out-of-bounds stack read. This only happens with a malformed bridge path stack.

In the Linux kernel, the net/sched/sch_fq_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before restoring the qlen counter. This can lead to incorrect deactivation of the parent class and, consequently, to a wild memory access in the qfq scheduler, manifesting as a general protection fault.

In the Linux kernel's airoha network driver, there is a heap buffer overflow in the foe_check_time function. The array is declared as a u16 pointer but allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16), leading to out-of-bounds writes.

In the Linux kernel, a vulnerability was found in the LWT (Lightweight Tunnels) mechanism. During LWT encapsulation, skb metadata (passed between XDP and TC) located in the packet headroom is overwritten or cleared, leading to warnings and errors, especially for forwarded packets carrying XDP metadata. The issue affects all LWT encapsulation types (mpls, seg6, ioam6, BPF) and all LWT redirect modes.

In the Linux kernel, the qede driver had an out-of-bounds check issue in cqe->len_list[], where the index check was performed after element access. The fix moves the index check before the access.

In the Linux kernel, the parse_dcc() function in netfilter nf_conntrack_irc had an off-by-one error leading to an out-of-bounds read. It treated the end pointer as inclusive, while the caller passed a pointer one past the last valid byte. The fix changes the loop to strict less-than, consistent with the caller's convention.

In the Linux kernel, the batman-adv dat module does not reassign the ARP hardware source pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

SOY CMS has an issue with deserialization of untrusted data. An attacker may execute arbitrary code with web server privileges.

The WPMU DEV Dashboard plugin for WordPress up to version 5.0.1 is vulnerable to Authentication Bypass due to inconsistent HMAC message construction between the `wdpsso_step1` and `wdpsso_step2` AJAX actions. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2, resulting in an authenticated administrator session.

A Cross-site Scripting vulnerability in the extract domain function in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

XSS vulnerability in Pocket up to version 8.33.0.0. The 'Save to Pocket' feature injects external HTML into the DOM, allowing JavaScript code to alter application state via native bridge methods.

OS Command Injection vulnerability in NUMail developed by Green-Computing. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

Vulnerability in WatchGuard Dimension: web UI diagnostic log stores unredacted session identifiers for logged-in users. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token, enabling account takeover.

Wazuh versions 4.4.0 through 4.14.6 contain a vulnerability that allows a party holding the cluster key to write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, potentially leading to remote code execution as root. The issue stems from incomplete path verification during cluster file synchronization. This is fixed in version 4.14.7.

A stack-based buffer overflow in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

A heap overflow vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

The Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.