CVE Vulnerability Catalog

A use-after-free vulnerability has been found in the Linux kernel's BPF sockmap mechanism during send verdict processing. The issue occurs because tcp_bpf_send_verdict() copies a pointer to the destination socket without taking a reference, which can lead to use of freed memory under concurrent access. An attacker could exploit this flaw to escalate privileges or cause a system crash.

In the Linux kernel, the SCTP protocol has a bug where a chunk's transport pointer is not updated when moved to another transport's list. This can lead to use-after-free when the transport is removed and the pointer becomes stale. The fix sets chunk->transport during the move.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the ASCONF mechanism. The cached ASCONF chunk is not properly cleared after release, leading to access to stale memory. The fix clears the addip_last_asconf pointer after release and protects against a race with T4 expiry.

A use-after-free vulnerability was found in the Linux kernel's SCTP subsystem. An authenticated remote SCTP peer can add and remove a transport within a single ASCONF chunk, leaving the new_transport pointer dangling. Subsequent operations (e.g., sending a HEARTBEAT) may read freed memory, as shown by a KASAN report in sctp_outq_select_transport.

In the Linux kernel, the Thunderbolt subsystem has an out-of-bounds read vulnerability during DROM parsing. The dual_link_port_nr field, derived from the device, is not properly validated before being used as an index into the sw->ports array. This can lead to an out-of-bounds pointer and subsequent dereference.

The WS Form LITE plugin for WordPress up to version 1.10.80 is vulnerable to PHP Object Injection via deserialization of untrusted input from form submission meta values. An unauthenticated attacker can inject a PHP object, but impact is limited unless a POP chain is present via another plugin or theme.

The Joomla extension Fabrik before version 4.7.2 contains a heredoc terminator breakout vulnerability in the calc element. Additionally, the onUpdateComment endpoint did not perform any access checks.

The Joomla extension Fabrik before version 4.7.2 contains an unauthenticated stored XSS vulnerability. The handling of user-supplied input in the jsactions feature leads to a stored XSS vector.

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated disclosure of commenters' email addresses. The onGetEmail endpoint does not perform any access checks.

Joomla extension Fabrik before 4.7.2 has a missing ACL check in the download element, potentially allowing unauthorized file access.

Joomla extension Fabrik before 4.7.2 is vulnerable to Path Traversal via the image element, potentially allowing access to files outside the application directory.

Joomla extension Fabrik before 4.7.2 allows remote code execution via the image element.

Joomla extension Fabrik before 4.7.2 has an unauthenticated remote code execution vulnerability via the PHP form element, which executes user-provided code.

The Joomla extension Fabrik before version 4.7.2 has a vulnerability due to missing access controls in the form.inlineedit controller, allowing unauthenticated users to read form data.

Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in ORDER BY, as the order parameter in list models is used in queries without validation, allowing read SQLi vectors.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated row reordering. The order plugin does not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated deletion of any comment. The DeleteComment endpoint does not perform any access checks.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to disclose the list of database tables and the table prefix. The ajax_tables method of the elements model permits listing arbitrary database tables including their columns.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to list arbitrary directories on the server. The onAjax_getFolders method of the elements model permits arbitrary directory listings.