CVE Vulnerability Catalog

In Rocket.Chat before versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, the CAS login handler forwards the client-supplied `credentialToken` value directly into a MongoDB `findOne({_id: ...})` query without any runtime type check. An unauthenticated attacker can substitute a NoSQL query operator (e.g., `{"$gt": ""}`) for the expected ticket string, matching the first unexpired document in the `credential_tokens` collection and completely bypassing the CAS ticket check.

FOSSBilling versions 0.7.2 and prior have a vulnerability in the guest API that allows the creation of new administrator accounts even when one already exists. A flaw in the admin existence check enables an attacker to bypass protections.

Ghost is a Node.js content management system. In versions up to 6.37.0, when Ghost is behind a shared caching layer, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response.

Rclone versions 1.46.0 through 1.74.2 have a vulnerability in server mode (rcd --rc-serve) that allows unauthenticated GET and HEAD requests to execute arbitrary system commands. An attacker can craft a URL containing remote storage configuration that executes local commands during initialization.

Use after free in WebGL in Google Chrome on Android prior to version 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

A use-after-free vulnerability in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

A vulnerability in concurrent-ruby up to version 1.3.6 allows any thread to release a write lock without authorization, potentially breaking mutual exclusion. Additionally, release_read_lock can decrement the shared counter below zero, causing ResourceLimitError on read lock acquisition.

Vulnerability in the Linux kernel in the bcmgenet driver (Broadcom GENET Ethernet) due to an off-by-one error in bcmgenet_put_txcb. Incorrect pointer rewind may lead to improper cleanup of the transmit buffer.

In the Linux kernel, the bcmgenet driver has a flawed timeout handler: it stops all transmit queues when a single queue times out, causing race conditions with queues that are still functioning. The fix restarts only the timed-out queue.

In the Linux kernel's hisilicon/sec2 driver, a use-after-free vulnerability was found during packet transmission. Under heavy system load, hardware may complete packet processing and free the request memory (req) before the transmission function finishes, causing an error.

In the Linux kernel, the GFS2 filesystem lacked proper log locking in the gfs2_logd() function. Log flushing functions (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) were called without holding the sd_log_flush_lock, potentially causing race conditions with concurrent transactions. A new __gfs2_log_flush() function and proper locking were added to gfs2_logd().

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module related to the Qualcomm Crypto Engine (QCE). The ksmbd_crypt_message() function does not properly handle the -EINPROGRESS return code from async hardware, leading to premature DMA request freeing and freed memory dereference in the callback.

In the Linux kernel, the memory driver for Tegra124 (tegra124-emc) had a reversed check for DLL enable in the EMRS register. DLL is enabled when bit A0 is low, but the code checked the opposite.

In the Linux kernel's OCFS2 filesystem and its DLM (Distributed Lock Manager) component, a vulnerability was found due to missing validation of the `qr_numregions` field in the `dlm_match_regions()` function. An attacker can send a crafted DLM_QUERY_REGION network message with an inflated `qr_numregions` value, causing an out-of-bounds read beyond the `qr_regions` buffer.

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module's smb2_open function during durable reconnect. Premature release of the file descriptor reference leads to use of freed memory when accessing file properties upon error or scavenger access.

A vulnerability was found in the Linux kernel's icmpv6_rcv() function for IPv6. Caching source and destination addresses before calling pskb_pull() can lead to a use-after-free (UAF) because pskb_pull() may change the skb->head pointer.

In the Linux kernel netfilter/conntrack subsystem, a stack buffer overflow was found in the mangle_content_len() function. The fix replaces sprintf() with scnprintf() and increases the buffer size.

In the Linux kernel, a vulnerability in the netfilter nfnetlink_osf module causes an out-of-bounds read during TCP option matching. The bug occurs because the shared ctx->optp pointer is not restored after early return in nf_osf_match_one(), leading to garbage data reads and incorrect logging when NF_OSF_LOGLEVEL_ALL is enabled.

In the Linux kernel, a double-free vulnerability in tipc_buf_append() due to tipc_msg_validate() reallocating the buffer. This can lead to memory corruption and potentially privilege escalation.

In the Linux kernel's NVMe-over-TCP driver, a vulnerability was found where nvmet_tcp_build_pdu_iovec() fails to propagate errors (e.g., out-of-bounds PDU length) to its callers. Consequently, callers like nvmet_tcp_handle_h2c_data_pdu() proceed with an uninitialized message iterator, potentially reading network data into an invalid buffer.