CVE Vulnerability Catalog

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contain an authenticated remote code execution vulnerability that allows authenticated administrators to execute arbitrary PHP code on the server.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.

PraisonAI is a multi-agent teams system. Prior to versions 4.6.37 for praisonai and 1.6.37 for praisonaiagents, the system resolves unresolved tool names against module globals and __main__, potentially leading to unintended application calls.

PraisonAI is a multi-agent teams system that in versions from 2.5.6 to before 4.6.34 ships a Flask API server with authentication disabled by default. This allows anyone who can reach the server to invoke the workflow from agents.yaml without providing a token.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI. An attacker can upload a controlled template, allowing for the execution of arbitrary template expressions and potentially achieving remote code execution depending on the enabled template plugins.

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in the targeted directory with the privileges of the api.app process.

A vulnerability has been identified in the Linux kernel related to the processing of SIDs in the context of NFS. The issue lies in the parse_dacl() function potentially reading data beyond the bounds of the ACE, which could lead to unauthorized access.

A vulnerability has been identified in the Linux kernel that leads to improper access to hypervisor-owned memory on Monaco-based platforms. This issue results in 'Synchronous External Abort' exceptions and kernel crashes.

In the Linux kernel, the IPv6 subsystem's addrconf_permanent_addr() function tries to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion. This can lead to a use-after-free.

In the Linux kernel, smp_cmd_pairing_req() built the pairing response from the initiator's auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omitted SMP_AUTH_MITM, the response could also omit it, leading to inconsistent pairing method selection.

In the Linux kernel, the thermal core subsystem has a bug in the thermal zone device registration error path. If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it does not wait for the tz->removal completion, potentially leading to premature freeing of tz.

In the Linux kernel netfilter flowtable subsystem, the maximum number of hardware offload actions is insufficient for IPv6, causing errors. The patch raises the limit to 24 and adds strict checking.

W jądrze Linuxa zidentyfikowano podatność związana z podwójnym zwolnieniem pamięci w funkcji cpufreq_dbs_governor_init(). Problem występuje, gdy kobject_init_and_add() kończy się niepowodzeniem, co prowadzi do wielokrotnego wywołania funkcji zwalniającej pamięć.

A vulnerability related to use-after-free (UAF) in the le_read_features_complete function has been fixed in the Linux kernel, which could lead to memory management errors.

W jądrze Linuxa rozwiązano podatność dotyczącą niewłaściwego oznaczania rejestrów żywych dla skoków pośrednich w instrukcji `gotox rX`. Rejestr rX powinien być oznaczony jako używany w funkcji compute_insn_live_regs().

A vulnerability has been identified in the Linux kernel's interrupt handling for the ADXL380 accelerometer, allowing for reading more FIFO entries than actually available. The issue arises from a mismatch between how the sensor fills the FIFO and the number of active channels.

A vulnerability in the Linux kernel has been resolved by clearing the page->private value in the free_pages_prepare() function. This issue led to a use-after-free in the swap subsystem, potentially causing system crashes.

A vulnerability in the Linux kernel has been resolved that could lead to buffer issues when starting streaming in the uvcvideo module fails. In case of a uvc_pm_get() error, the buffer will be returned, potentially preventing warnings related to the xHCI controller.

In the multi-agent system PraisonAI, prior to versions 4.6.9 and 1.6.9, vulnerabilities related to lack of input validation existed across various database backends, leading to potential SQL injection. The issue affects 52 unvalidated injection points in the codebase.