CVE Vulnerability Catalog

Wtyczka Cloud SAML SSO dla WordPressa jest podatna na nieautoryzowaną modyfikację danych z powodu braku sprawdzenia uprawnień w akcji 'set_organization_settings' funkcji csso_handle_actions() w wersjach do 1.0.19 włącznie. Atakujący mogą zmieniać krytyczne ustawienia konfiguracyjne, co może prowadzić do przerwania działania SSO oraz odmowy usługi.

Wtyczka Multi Step Form dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu braku walidacji typu pliku w funkcji importu we wszystkich wersjach do i włącznie z 1.7.25. Umożliwia to uwierzytelnionym atakującym z dostępem na poziomie Administratora i wyżej przesyłanie dowolnych plików na serwer dotkniętej witryny.

Motyw REHub - Porównywarka cen, Multi Vendor Marketplace dla WordPressa jest podatny na wykonanie dowolnego shortcode'a we wszystkich wersjach do 19.9.7 włącznie. Problem wynika z braku odpowiedniej walidacji wartości przed wykonaniem funkcji do_shortcode.

Frappe, a full-stack web application framework, versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter vulnerable to error-based SQL Injection due to lack of validation. Sensitive information such as versioning can be retrieved. Fixed in versions 14.96.10 and 15.72.0.

Niewystarczające sprawdzanie granic w AMD TEE (Zaufane Środowisko Wykonawcze) może umożliwić atakującemu z naruszonym użytkownikowym środowiskiem wywołanie polecenia z nieprawidłowymi argumentami, co prowadzi do dostępu do pamięci poza dozwolonym zakresem.

A vulnerability in Podman allows an attacker to overwrite host files using the 'kube play' command when the kube file contains a Secret or ConfigMap volume mount with a symbolic link to a host file path. The attacker can control which file is overwritten but not the content written.

W PHPGurukul Online Course Registration w wersji 3.1 odkryto podatność, która dotyczy nieznanej funkcji w pliku /admin/semester.php. Manipulacja argumentem 'semester' prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

In the Linux kernel netfs subsystem, a bug was found in unbuffered write error handling. When all subrequests in an unbuffered write stream fail, the stream->transferred variable is not updated and retains its initial LONG_MAX value. This causes ->write_iter() to return LONG_MAX instead of an error, potentially leading to a kernel oops when cleaning pipe buffers.

In the ksmbd SMB server in the Linux kernel, a refcount leak was detected that prevents memory release. When ksmbd_conn_releasing() returns true, the refcount is not properly decremented, leading to a leak and resource not being freed.

In the vsock/virtio driver in the Linux kernel, there was no validation of the length in the packet header before calling skb_put(). If the host advertises an excessive length, it could cause SKB buffer overflow. The fix adds length validation before skb_put().

In the Linux kernel, a vulnerability was found in the open_tree_attr(2) function that allowed changing idmappings for a mounted filesystem without using the OPEN_TREE_CLONE flag. This bypass could lead to security issues such as use-after-free (UAF) and locking problems.

In the Linux kernel's USB TV driver (usbtv), the resolution is not locked during streaming. Changing the TV standard (e.g., NTSC to PAL) while playing can cause a video buffer overflow and system crash.

In the Linux kernel, the ACE and CSI drivers are missing a mei_cldev_disable() call in their remove() function, causing a use-after-free vulnerability during shutdown. The MEI client remains on the device file list after its memory is freed, leading to a crash.

In the Linux kernel's Venus (multimedia codec) driver, the packet size read from shared memory is not validated against available data, potentially causing an out-of-bounds memory read.

In the Linux kernel for LoongArch architecture in the KVM module, a buffer overflow vulnerability was found in the send_ipi_data() function. The kvm_io_bus_read() function is called with a buffer smaller than 8 bytes, while emulation functions write 8 bytes, causing stack corruption and kernel panic when CONFIG_STACKPROTECTOR is enabled.

In the Linux kernel, in the io_uring/futex subsystem, there is a vulnerability due to improper cleanup of async_data on failure in io_futex_wait(). The REQ_F_ASYNC_DATA flag is not set, and data is not cleared after an error, potentially leading to use of uninitialized memory.

In the Linux kernel's NFS filesystem, there is a race condition when updating an existing write. Lack of early page group locking may lead to request removal before processing. The fix moves the lock earlier.

In the tas2781 HDA audio driver in the Linux kernel, there is a reference error to the tasdevice_priv structure. An incorrect pointer was used, leading to memory corruption and crashes.

In the Linux kernel's SCLP subsystem on s390, the NULL check for the SCCB address is performed after physical-to-virtual address translation. If the identity mapping does not start at zero, the check fails, potentially leading to incorrect memory access.

A use-after-free vulnerability was found in the Linux kernel's bh_read() helper in fs/buffer.c. The issue occurs during NTFS3 filesystem mount when a stack variable 'map_bh' is passed to ntfs_get_block_vbo(), and after buffer unlock it may be prematurely freed, leading to a stack out-of-bounds read.