CVE Vulnerability Catalog

In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DMA command body size is not checked against the suffix pointer. This can cause the suffix pointer to underflow and overwrite verified fields of a previous command, enabling a TOCTOU attack. The fix rejects the command if the body is too small.

In the Linux kernel, the vmwgfx driver has a vulnerability where destroy_workqueue(NULL) is called during vkms init failure when the workqueue was not created. This can cause a kernel panic. The fix removes the early return and adds a NULL check before destroying the workqueue.

A vulnerability in the Linux kernel USB Type-C UCSI driver causes a race condition during port unregistration, potentially leading to use-after-free and kernel crashes (NULL pointer dereference). The issue involves synchronization of partner work items with workqueue destruction.

In the Linux kernel, the drm/xe driver's exec IOCTL did not wait on kernel fences for external BOs, potentially causing a race and memory corruption during moves. The fix adds kernel fence dependencies for all objects locked by the exec.

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.

In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.

A vulnerability in the D-Link DIR-842 router (version 2.01.B04) affects an unknown function in the /etc/vsftpd.conf file of the vsftpd component. Manipulation leads to incorrect default permissions. The attack can be launched remotely but has a high complexity level and is considered difficult to exploit.

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL injection via the 'sorting' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with translator-level access and above to append additional SQL queries to extract sensitive information from the database.

Apache Struts is vulnerable to uncontrolled resource consumption. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

Apache Struts is vulnerable to uncontrolled resource consumption. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. Applications that do not collect violation reports are not affected.

The JSON plugin of Apache Struts is vulnerable to exposure of data element to wrong session. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

A vulnerability in the JSON plugin of Apache Struts allows per-request parsing state to be shared across concurrent requests, potentially exposing data from one request to another and not enforcing configured parsing limits. Populating actions from JSON request bodies is not enabled by default, so applications not using the JSON plugin are unaffected.

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. It affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. Manipulation of the argument exchange_mode causes missing encryption of sensitive data. The attack can be initiated remotely, but the complexity is rather high and exploitability is reported as difficult.

The Templately plugin for WordPress (up to and including version 3.7.1) contains a Remote Code Execution (RCE) vulnerability in the fetch_remote_file function. The issue stems from a filename validation/destination mismatch — file type is validated against the Content-Disposition header, while the actual write path is derived from the URL, allowing a file with a .php extension to be written. An attacker with contributor-level access can bypass the unfiltered_upload capability gate and execute code on the server.

The TrueBooker plugin for WordPress up to version 1.2.6 is vulnerable to account takeover. The add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This allows unauthenticated attackers to change any user's email address, including an administrator's, and then use the native password reset flow to take over the account.

The Real Estate Manager Pro plugin for WordPress up to version 12.8.6 is vulnerable to privilege escalation. The allow_attachment_actions() function has improper capability handling, which can treat a target user ID as a media attachment ID during user capability checks. This allows authenticated attackers with Subscriber-level access and above to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.

The Wholesale Market plugin for WordPress up to version 2.2.2 is vulnerable to privilege escalation via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (exposed to any authenticated user) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.