CVE Vulnerability Catalog

Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.

Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.

In the NVMe/TCP subsystem of the Linux kernel, when a data digest mismatch occurs on a non-final H2C_DATA PDU, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed. This leads to a double call to nvmet_req_uninit() during queue teardown, resulting in a double free and potential use-after-free (UAF).

In the NVMe/TCP subsystem of the Linux kernel, in nvmet_tcp_try_recv_ddgst(), the call to nvmet_req_uninit() is unconditional. If the command arrived via the nvmet_tcp_handle_req_failure() path, the percpu_ref was never taken, leading to a refcount underflow and potential use-after-free.

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before version 5.37 does not authenticate one of its request handlers. Its only protection is a cryptographic key that is empty in the default, unconfigured state. Unauthenticated attackers can write an arbitrary file into a web-accessible directory and achieve remote code execution.

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

A vulnerability in the Linux kernel involves the TC_ACT_CONSUMED case in the tcf_qevent_handle function in net/sched/cls_api.c. When tcf_classify() returns TC_ACT_CONSUMED, the skb is held by the defragmentation engine and must not be touched further. Missing handling leads to a use-after-free (UAF) in red_enqueue().

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier.

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, gated only by a general auth check with no admin-role or read-only enforcement, exposing 31 MCP tools including file operations across the entire workspace.

In the Linux kernel net/handshake mechanism, a long-lived file reference was missing during handshake request processing. Using sock_hold() did not protect the socket structure from being destroyed by the consumer, potentially leading to use-after-free.

In the Linux kernel, the tcp_ao_destroy_sock function removed the call_rcu() call, breaking RCU synchronization. During connection setup (TCP_SYN_SENT), the socket is visible to other CPUs, which may read the ao_info pointer just before it is freed, leading to a use-after-free vulnerability.

In the Linux kernel, a vulnerability in the TIPC broadcast mechanism allows an out-of-bounds read. The tipc_get_gap_ack_blks() function fails to verify that the Gap ACK block record fits within the message data area, enabling an attacker to trigger a kmemdup() read beyond the allocated skb buffer.

In the Linux kernel's crypto: krb5 module, a use-after-free occurs when using async AEAD implementations. Cryptographic functions set a NULL callback and treat any negative return as an error, freeing the buffer. When the implementation is async, it returns -EINPROGRESS and the buffer is freed while the backend still uses it.

In the Linux kernel netfilter flowtable subsystem, hardware offload for IPIP tunnels is not yet supported. Despite this, offload attempts are queued to a worker and then ignored, causing unnecessary overhead. The patch adds early checking and bail-out for IPIP tunnel offload.

In the Linux kernel ksmbd SMB server, the FSCTL_DUPLICATE_EXTENTS_TO_FILE function lacks write permission checks at the share and handle levels, allowing a client to overwrite destination file data even on a read-only share or with a FILE_WRITE_ATTRIBUTES handle.

In the Linux kernel, the ksmbd filesystem has a concurrency issue with directory queries. Concurrent QUERY_DIRECTORY requests for the same file handle can overwrite a stack pointer, leading to a use-after-free.

In the Linux kernel, the ksmbd filesystem runs SET_INFO operations with the current ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass owner-based and LSM access controls.