CVE Vulnerability Catalog

In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the build_secret_key function in dtale/app.py, related to Flask session cookies. The issue is insufficiently random values, which may allow an attacker to predict the session key. The attack is remote but requires high complexity. The exploit has been published, and a pull request with a fix awaits acceptance.

In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.

In @fastify/multipart, a multipart form-data parser for Fastify, versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects during processing. An unauthenticated client can repeat this to cause persistent disk consumption and denial of service. The issue is fixed in version 10.1.1.

In @fastify/multipart, versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client aborts the connection before sending the terminating boundary, saveRequestFiles() never settles, and the temporary file is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in version 10.1.1.

In @fastify/jwt, a JSON Web Token plugin for Fastify, versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret. Applications using different keys for different authorization domains may accept tokens signed with the global key on routes requiring another key, allowing an ordinary authenticated user to cross a key-based trust boundary. The issue is fixed in version 10.2.2.

The @fastify/oauth2 plugin for Fastify, versions 7.2.0 up to but not including 8.3.0, improperly validates the OAuth state and PKCE code verifier by comparing callback query parameters against an unprefixed, predictable cookie, with no server-side binding to the browser. An attacker can set cookies and perform a login CSRF attack, silently signing the victim into the attacker's account. The fix in 8.3.0 adds an opt-in hostPrefixedCookies option.

A vulnerability in Dancer2::Plugin::Auth::Extensible (through 0.713) for Perl allows password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Default emails emit a link with authority from the Host header or X-Forwarded-Host (under behind_proxy). An unauthenticated POST to /login with submit_reset and a username stores a fresh reset code and emails a link to a host chosen by the attacker. If the recipient follows the link, they hand a working reset code to the attacker's host, enabling account takeover.

In the Linux kernel, the mpls_getroute() function did not initialize the rtm_tos field in the rtmsg structure, leading to a one-byte leak of uninitialized heap memory to user space when receiving RTM_GETROUTE replies. The issue was detected by KMSAN and affects the MPLS protocol.

A vulnerability in the Linux kernel leads to unbounded recursion in the memory free path of the slab allocator. Cycles between obj_exts arrays of different kmalloc caches can cause stack overflow and system crash.

In the Linux kernel, the Thunderbolt subsystem has a use-after-free vulnerability in XDomain delayed work during disconnect. The tb_xdp_handle_request() function may queue delayed work after tb_xdomain_remove() cancels it synchronously but before the xdomain object is freed, leading to work executing on freed memory. The fix adds an xd->removing flag and synchronization via xd->lock.

In the Linux kernel, the dmaengine idxd driver has a cleanup issue after fdev setup failure in idxd_cdev_open(). The failed_dev_add and failed_dev_name paths drop the file-device reference while holding wq->wq_lock, which can deadlock if put_device() triggers idxd_file_dev_release() trying to reacquire the same lock. Additionally, these paths fall through to later ctx cleanup labels that may operate on freed context. The fix moves idxd_wq_get() before possible failure and unlocks wq->wq_lock before put_device().

In the Linux kernel, the iommu/arm-smmu-v3-iommufd subsystem has a vulnerability where arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID, assuming a device has exactly one stream. Devices with multiple streams get only the first one mapped, so vSID invalidations cannot reach the others' ATC and IOTLB entries; devices with none cause an out-of-bounds read. The fix adds an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one.

In the Linux kernel, a deadlock was found in the btrfs subsystem for zoned filesystems between metadata writeback and transaction commit. The issue occurs when metadata writeback holds the zoned_meta_io_lock and then tries to activate a zone, which requires waiting for a transaction commit that needs the same lock. The fix releases the lock before calling btrfs_zone_finish_one_bg() and re-acquires it afterwards.

In the Linux kernel, the btrfs filesystem has a NULL pointer dereference vulnerability when mounting with rescue=ibadroots after corrupting the block group tree or RAID stripe tree root. The function btrfs_update_global_block_rsv() dereferences the missing root based on the feature bit, causing a crash.

In the Linux kernel, the NTFS filesystem has a vulnerability related to unsafe size calculations during runlist reallocation. A shared helper was added to safely convert runlist element counts to byte sizes with overflow checks, used in ntfs_rl_realloc() and ntfs_rl_realloc_nofail().

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to an s16 overflow in the size change counter during NAT rewriting. A single SIP message can grow by more than 32767 bytes, causing the counter to wrap and leading to an out-of-bounds read (use-after-free).

In the Linux kernel's KVM/arm64 VGIC subsystem, a race condition exists between releasing an LPI structure and re-registering it. This can lead to deletion of a newly registered LPI from the xarray or to a memory leak of the old structure. The issue is triggered by guest operations such as DISCARD and MAPTI.

In the Linux kernel, the keys subsystem has an out-of-bounds read vulnerability in keyring_get_key_chunk(). For description-level chunks, the read pointer is advanced by level * sizeof(long) past the inline prefix but only the prefix is bounds-checked, allowing reads past the allocated memory for long key descriptions.

In the Linux kernel, the keys subsystem has a vulnerability due to byte order disagreement in keyring key chunks between keyring_get_key_chunk() and keyring_diff_objects(). Differences in byte order and bit position can allow key collisions, potentially leading to incorrect key placement in keyrings.

In the Linux kernel, netfilter nf_tables has a use-after-free vulnerability due to a global rhltable for nft objects. This allows access to objects being dismantled from other network namespaces, potentially leading to use-after-free.