CVE Vulnerability Catalog

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to XSS. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers, HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. An attacker can bypass sanitization to inject active HTML and JavaScript, e.g., via encoded javascript: URLs, backslash-based relative URLs, markup-breaking names, raw </textarea> reintroduction, or preserved <style>/<meta http-equiv=refresh>/<base href> tags.

A privilege escalation vulnerability in the StackGres operator allows a low-privileged tenant who owns a database to gain administrator privileges.

The RestrictMate WordPress plugin before version 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.

In the Linux kernel, in NFS, the FREE_STATEID operation could be delayed, leading to a use-after-free of the 'struct nfs_server' object. The fix bumps the refcount of this object for the duration of the FREE_STATEID call to prevent cleanup while operations are in flight.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

A vulnerability in the Linux kernel's btrfs filesystem was found in LZO decompression for inline extents. A crafted btrfs image can trigger an out-of-bounds read (KASAN: slab-out-of-bounds) when reading a file, leading to a system crash or potential security compromise.

In the Linux kernel, a vulnerability in the vdpa/mlx5 driver leads to a slab-out-of-bounds read. The issue is caused by incorrect calculation of the input buffer size in create_direct_keys(), resulting in reading 16 bytes beyond the allocated region.

In the Linux kernel, __skb_udp_tunnel_segment() has a potential use-after-free vulnerability. It gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability. sctp_make_heartbeat_ack() caches a pointer to the transport without taking a reference, and when the transport is removed, a queued control chunk may retain a dangling pointer, leading to memory corruption.

In the Linux kernel, IPVS does not clear IPv4 options after rebasing tunnel ICMP errors, potentially leading to a stack out-of-bounds write via __ip_options_echo().

In the Linux kernel, generic XDP fragment adjustment leaves skb->len stale, causing skb_headlen() to be larger than the actual linear area. In the UDP receive path, this can copy data beyond the linear area to userspace.

In the Linux kernel inet_frag_create(), the fragment queue timer is armed before the queue is published in the hash table. If the fragment timeout is zero or negative, the timer can run before publication, causing a race and leaving a stale hash node.

In the Linux kernel, the X.25 protocol has a use-after-free vulnerability of the socket by its timers. Timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, which can lead to use-after-free.

In the Linux kernel, the dibs module initializes the dibs->lock too late, only in dibs_dev_add(), while interrupts can occur earlier. This can lead to use of an uninitialized lock in interrupt handling.

In the Linux kernel, xdpf_clone() creates clones of XDP frames but does not sufficiently check whether data fits within the skb_shared_info tailroom. This can lead to data corruption when converting a clone to an skb.

A vulnerability in the Linux kernel's veth interface was found where skb length accounting was incorrect after XDP fragment adjustment, leading to copying data beyond the actual linear area, including kernel pointers, to userspace. Additionally, bpf_xdp_pull_data() could trigger SKB_LINEAR_ASSERT() due to improper tail pointer management.

In the Linux kernel, in TLS RX, during optimistic TLS 1.3 zero-copy attempt, the msg_iter pointer is not restored after a failed attempt, which can lead to overwriting data in the receiver's buffer.

In the Linux kernel, in the SMB client, cifs_try_adding_channels() can use-after-free an interface when channel creation fails and the interface list is refreshed concurrently.