CVE Vulnerability Catalog

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.

A vulnerability in the ObsidianReader class of run-llama/llama_index version 0.12.27 allows hardlink-based path traversal. Attackers can bypass path restrictions and access sensitive system files such as /etc/passwd by exploiting hardlinks; the flaw stems from inadequate hardlink handling in the load_data() method. The issue is resolved in version 0.5.2.

An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This allows an attacker to obtain the administrator's token by sending a payload in the published chat; when the administrator views the conversation content through the monitoring/log function using Firefox, the XSS is triggered, potentially exposing sensitive token information.

W MbedTLS w wersjach od 3.3.0 do 3.6.4 funkcja mbedtls_lms_import_public_key nie sprawdza, czy bufor wejściowy ma co najmniej 4 bajty przed odczytem 32-bitowego pola, co może prowadzić do odczytu poza granicami na skróconym wejściu. Atakujący mogą wykorzystać tę lukę, aby spowodować awarię lub ujawnienie ograniczonych danych z sąsiedniej pamięci.

W MbedTLS w wersjach od 3.3.0 do 3.6.4, funkcja mbedtls_lms_verify może akceptować nieprawidłowe podpisy, jeśli obliczenie hasha nie powiedzie się, a wewnętrzne błędy nie są sprawdzane. To umożliwia fałszowanie podpisów LMS w scenariuszach z błędami sprzętowymi.

A bug in the Linux kernel's uprobe handling can cause a page table entry (PTE) to be overwritten when expanding a VMA. Through mremap and VMA merging operations, a uprobe PTE becomes orphaned, triggering a 'Bad rss-counter state' warning and potentially leading to memory accounting inconsistencies.

In the Linux kernel, the drm/amd/display driver has a divide-by-zero vulnerability when dummy values in populate_dummy_dml_surface_cfg() are not updated. This can lead to a divide-by-zero error in functions like CalculateVMAndRowBytes(). The fix initializes the dummy value to 1 to avoid division by zero.

A concurrency bug in the Linux kernel's jfs module leads to a null pointer dereference in jfs_ioc_trim. The pointer JFS_SBI(ipbmap->i_sb)->bmap can be set to NULL in dbFreeBits and then dereferenced in jfs_ioc_trim, causing a kernel panic. The vulnerability is locally triggerable via an ioctl call on a JFS filesystem.

In the Linux kernel, the ath12k Wi-Fi driver has a memory leak caused by redundant rx_stats allocations when the same station is added multiple times. ath12k_mac_station_add() allocates rx_stats each time without checking whether it is already allocated.

In the Linux kernel on LoongArch, huge_pte_offset() may return NULL for pmd, leading to a kernel panic when handling hugepages (e.g., via madvise). The fix adds a check for this situation before further processing.

In the Linux kernel, the drm/msm/a7xx driver fails to call the CP_RESET_CONTEXT_STATE packet when switching contexts. State used by userspace to synchronize between BR and BV is not reset, which can cause another context to malfunction.

A double-free vulnerability was found in the key export functionality of libssh. During error handling, a memory structure is freed but not cleared, potentially leading to a double free if another failure occurs. This could cause heap corruption or application instability in low-memory scenarios.

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values, the function may mistakenly return a success status even when key derivation fails.

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.

In the Linux kernel, a bug was fixed in the dm (device mapper) function dm_revalidate_zones(), which failed to properly update zoned settings on table reload when the device already had zone write plug resources. This caused a mismatch in conv_zones_bitmap size and invalid memory read errors. The fix restricts table reloads that change zoned settings for devices with allocated zone plug resources.

In the Linux kernel, a race condition in the coresight subsystem was fixed when removing cscfg from csdev. Missing the cscfg_csdev_lock during removal could cause iteration over config_csdev_list concurrently with its modification, risking data corruption or a crash.

In the Linux kernel, a vulnerability was found in the stmmac driver where the ptp_rate value is not validated before being used in EST configuration. If ptp_rate is 0, a division by zero occurs, potentially causing a system crash.

W jądrze systemu Linux zidentyfikowano podatność w kodzie USB-audio MIDI, która może prowadzić do nieprawidłowego działania timera podczas usuwania sterownika. W rzadkich przypadkach sterownik może zostać zwolniony bez wywołania funkcji odłączającej, co skutkuje ostrzeżeniem jądra w trybie debugowania.

In the Linux kernel, the iwlwifi driver was fixed to avoid an unnecessary warning in iwl_trans_reclaim when called during a pending restart after a firmware error. Instead of warning, it now returns silently.

A heap overflow vulnerability was discovered in WINSTAR WN572HP3 v230525 via the CONTENT_LENGTH variable in /cgi-bin/upload.cgi.