CVE Vulnerability Catalog

VirtualSquare picoTCP (also known as PicoTCP-NG) through version 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.

VirtualSquare picoTCP (also known as PicoTCP-NG) through version 2.1 does not have an MSS lower bound, meaning it could be set to zero.

VirtualSquare picoTCP (also known as PicoTCP-NG) through version 2.1 does not check the transport layer length in a frame before performing port filtering.

Lightdash versions before 0.510.3 have insecure file endpoints that allow directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the rkvdec_remove function in rkvdec.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the renesas_usb3_remove function in renesas_usb3.c.

An issue was discovered in the Linux kernel through 6.3.8 related to a use-after-free in the ravb_remove function in ravb_main.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the cedrus_remove function in cedrus.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the dm1105_remove function in dm1105.c.

An issue was discovered in the Linux kernel before version 6.3.2 related to a use-after-free in the saa7134_finidev function in saa7134-core.c.

A critical vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204, affecting unknown code of the file app.09df2a9e44ab48766f5f.js of the Admin Password Handler component. Manipulation of this vulnerability leads to improper access controls.

A critical vulnerability was found in the C-DATA Web Management System affecting an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the User Creation Handler component. Manipulation of the argument user/newpassword leads to improper access controls.

Two SQL Injection vectors have been identified in SugarCRM Enterprise before version 11.0.6 and 12.x before version 12.0.3. Due to missing input validation, custom SQL code can be injected through crafted requests in the REST API.

A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module in SugarCRM Enterprise before version 11.0.6 and 12.x before version 12.0.3. Missing input validation allows crafted requests to inject and execute custom PHP code.

A Bean Manipulation vulnerability has been identified in the REST API of SugarCRM Enterprise before version 11.0.6 and 12.x before version 12.0.3. By using a crafted request, custom PHP code can be injected due to missing input validation.

An Unrestricted File Upload vulnerability has been identified in the Notes module of SugarCRM Enterprise before version 11.0.6 and 12.x before version 12.0.3. Crafted requests can inject and execute custom PHP code due to missing input validation.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file manager functionality in versions up to and including 1.5.66. This allows authenticated attackers with contributor-level permissions and above to upload arbitrary files on the affected site's server.

An issue was discovered in libjxl before version 0.8.2 in dec_patch_dictionary.cc. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets, which may result in denial of service or privilege escalation.

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c. This flaw could allow a local attacker to crash the system or leak kernel internal information.