CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the GRO (Generic Receive Offload) mechanism allows merging zerocopy packets without checking the SKBFL_MANAGED_FRAG_REFS flag, potentially leading to use-after-free (UAF). The issue occurs when either the last packet in the GRO chain or the source packet is zerocopy.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() on build_skb() failure. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. Each failure in a batch leaks a page-frag chunk.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() when rejecting frames shorter than ETH_HLEN. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. A local attacker can exploit this to trigger an OOM panic.

In the Linux kernel, a memory leak occurs in tap_get_user_xdp() because pages are not freed on error paths, leading to page-frag leaks.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the net/sched: act_ct module during flow table lookup. The rhashtable_lookup_fast() function releases the RCU lock before incrementing the reference count, allowing concurrent freeing of the ct_ft object and leading to privilege escalation.

In the Linux kernel, KVM for ARM64 has a use-after-free vulnerability in the nested_mmus array. The array is reallocated without proper locking, which can lead to referencing freed memory by other threads.

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

The Mac Photo Gallery 3.0 WordPress plugin contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the albid parameter. Attackers can send requests to macdownload.php with directory traversal sequences to access sensitive files like wp-load.php outside the intended plugin directory.

The Apptha Slider Gallery plugin version 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.

The PICA Photo Gallery plugin 1.0 for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.

The KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kc_ad' parameter in base.css.php or kittycatfish.php to extract sensitive database information using boolean-based blind or time-based blind techniques.

The Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped 'idsignup' POST parameter. Attackers can send crafted requests to the admin-ajax.php endpoint with malicious SQL payloads in the 'idsignup' parameter to read arbitrary data from the database.

The Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.

The WordPress Car Park Booking plugin from October 13, 2017 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

The Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.

The Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the 'pollid' POST parameter. Attackers can send requests to the admin-ajax.php endpoint with the 'spAjaxResults' action and malicious 'pollid' values to execute arbitrary SQL queries and read sensitive data from the WordPress database.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) via the Media Module, potentially exposing sensitive files like logs. Affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Backend users with write access to the form_definition table can directly create, update, or delete form definitions via DataHandler, bypassing Form Framework validation and permission checks. This allows arbitrary form configurations, SQL injection, and privilege escalation.