CVE Vulnerability Catalog

In ToolJet prior to version 3.20.178-lts, any authenticated user with builder role (free tier) could overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executed server-side with full Node.js access. The malicious code ran whenever any user on the instance triggered a query using that plugin, leading to remote code execution (RCE) and supply-chain compromise of the entire ToolJet deployment.

The Premmerce Wishlist plugin for WooCommerce versions up to 1.1.11 contains a vulnerability to unauthenticated SQL injection.

There is an unauthenticated SQL injection vulnerability in MDTF versions <= 1.3.7.

SQL Injection vulnerability in YMC Filter allows an attacker to inject malicious SQL code. The flaw affects versions up to and including 3.11.5.

There is a remote code execution (RCE) vulnerability in Widget Options versions <= 4.2.3 that can be exploited by an attacker.

A vulnerability in Dell Wyse Management Suite (versions prior to WMS 5.5 HF1) involves accepting extraneous untrusted data along with trusted data. This allows a low-privileged attacker with remote access to execute code on the vulnerable system.

A vulnerability was found in the Linux kernel's TCP stack in reqsk_queue_hash_req(). Preemption between mod_timer() and refcount_set() can cause premature timer expiration and a refcount underflow, leading to use-after-free.

In the Linux kernel's mtk_eth_soc network driver, a use-after-free vulnerability was found. The mtk_free_dev() function calls metadata_dst_free() which immediately frees the metadata_dst memory, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer, which can lead to accessing freed memory if any skb still holds that pointer during driver teardown.

In the Linux kernel SCTP stack, the length of a cached INIT chunk in COOKIE_ECHO processing was not validated. Missing validation can lead to out-of-bounds reads and potential memory corruption.

In the Linux kernel, a vulnerability in the SIT (Simple Internet Transition) IPv6 module uses a stale inner IPv6 header pointer after GSO offloads. The ipip6_tunnel_xmit() function caches the pointer at entry, but iptunnel_handle_offloads() may relocate the skb buffer, causing reads from freed memory.

A vulnerability was found in the Linux kernel's SCTP stack in the __sctp_rcv_asconf_lookup() function. An unauthenticated peer can send a truncated ASCONF chunk that declares an IPv6 address but ends after the parameter header, causing uninitialized memory to be read.

In the Linux kernel, sctp_unpack_cookie() lacked validation of the embedded INIT chunk length and address list length in SCTP cookies. A truncated INIT or oversized address list can cause out-of-bounds reads.

In the Linux kernel, a bug was found in the vti6_tnl_lookup() function causing incorrect tunnel matching for IP6_VTI. During wildcard tunnel fallback search, missing checks allowed hash collisions to match tunnels without actual wildcard addresses.

In the Linux kernel, the mvpp2 driver incorrectly initializes the XDP frame size (frame_sz) to PAGE_SIZE instead of the actual RX buffer size from the BM pool. This allows bpf_xdp_adjust_tail() to grow a packet beyond the allocated buffer, causing memory corruption.

In the Linux kernel, a vulnerability in the mvpp2 driver allows an RX buffer to be returned to the BM pool after being handed to XDP or skb, causing use-after-free. The fix reorders operations to refill the BM pool before handing the buffer to XDP or skb.

In the Linux kernel, the RDMA/SRP driver lacks validation of the sense data length copied from SRP_RSP responses. A malicious or compromised SRP target on InfiniBand/RoCE can set a large resp_data_len, causing an out-of-bounds read beyond the received buffer and potentially a page fault.

In the Linux kernel's IB/isert driver, a missing lower bound check on iSER login PDU length allows a remote initiator to send a packet shorter than ISER_HEADERS_LEN (76 bytes). This causes an underflow in payload length calculation, leading to a buffer overflow during memcpy and a crash of the target node. No authentication is required to exploit this vulnerability.

A use-after-free vulnerability was found in the Linux kernel's IP fragment reassembly mechanism. During network namespace teardown, fqdir_pre_exit() flushes fragment queues but does not reset q->fragments_tail and q->last_run_head pointers, which still point to freed skbs. A fragment that obtained the queue before the flush may later dereference the freed memory, leading to a security breach.

In the Linux kernel's AF_RXRPC subsystem, a vulnerability was found in the ACK parser due to improper access to the SACK buffer in received UDP packets. The rxrpc_input_soft_acks() function modifies the skbuff and may incorrectly read data in case of packet fragmentation, potentially leading to parsing errors.

A vulnerability was found in the Linux kernel's netfilter subsystem where functions like `ip6t_eui64`, `xt_mac`, ipset types (`bitmap:ip,mac`, `hash:ip,mac`, `hash:mac`), and `nf_log_syslog` accessed the Ethernet header (`eth_hdr(skb)`) without first verifying that the skb is associated with an Ethernet device, that the MAC header is set, and that it spans at least a full Ethernet header. Missing these checks could lead to errors or potential security issues.