CVE Vulnerability Catalog

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

Microsoft UFO prior to 3.0.10 contains a vulnerability in the type_text and launch_app tools where text and package_name parameters are passed to adb shell commands without proper validation. An attacker with a valid Mobile MCP API key can execute additional commands on an authorized device as the Android shell user.

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where nocache_hash is not restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply data with a forged SmartyNocache marker that is copied into the PHP cache file, enabling arbitrary PHP execution.

Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection vulnerability in the mysql_query function in admin/login.php (Administrator Login Endpoint). Manipulation of username/password arguments allows remote attack.

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing brute force of two-factor codes. Attackers who know a user's password can reuse the ten-minute pending token to guess codes and obtain a full access token.

Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection vulnerability in the mysql_error function in login.php (Login Endpoint). Manipulation of username/password arguments allows remote attack.

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. An authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides, leading to arbitrary Twig evaluation and then system command execution.

A vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin involves insecure deserialization due to the use of PHP's native unserialize() function without restrictions on allowed classes. An attacker who can write to the cache backend (e.g., Redis, Memcached) can inject crafted PHP objects and execute arbitrary code.

In the WibuKey driver for Windows below version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

A bug was fixed in the Linux kernel xfrm subsystem where xfrm_trans_reinject(), after being converted from a tasklet to a workqueue, ran in process context without an RCU read lock. This caused suspicious RCU usage warnings and potential validity issues for dst and netdevice references of packets queued through the workqueue.

A vulnerability in the Linux kernel's ESP (IPsec) implementation was found on the out-of-place output path, where the skb frag array was mutated without downgrading managed zerocopy frags (SKBFL_MANAGED_FRAG_REFS). This breaks the managed-frag invariant, potentially leading to use-after-free of zerocopy pages and memory leaks.

In the Linux kernel, a vulnerability was fixed in the RDMA/siw driver in siw_accept(). If siw_qp_modify() fails, the QP's state_lock is released before error path cleanup, allowing a concurrent ibv_modify_qp() to transition the QP to ERROR and free the cep structure, leading to use-after-free. The fix clears qp->cep and drops the association reference under the held write lock.

In the Linux kernel's RDMA/rxe subsystem, a vulnerability exists where rxe_rereg_user_mr() reassigns the PD pointer before validating access flags. If validation fails, the MR remains in an inconsistent state, leading to a use-after-free of the PD memory.

In the Linux kernel xfrm subsystem, during bundle creation, a missing reference to net_device leads to a use-after-free when a concurrent interface deletion occurs. The fix reads dst->dev via dst_dev_rcu() and keeps the RCU read-side critical section active until xfrm_fill_dst() takes the required references.

In the Linux kernel RDMA/rxe subsystem, the HMM_PFN_WRITE check has been restored in ODP write paths. A previous fix removed the access permission test, allowing an unprivileged user to modify read-only pages (e.g., file cache) via RDMA operations, similar to Dirty COW. The fix requires HMM_PFN_WRITE for all write operations, preventing overwriting read-only files.

In the Linux kernel, the RDMA/rxe module contains a use-after-free vulnerability. The rxe_get_mcg() function publishes a newly allocated multicast group in the mcg_tree before the backing Ethernet multicast address is programmed via rxe_mcast_add(). If rxe_mcast_add() returns an error, the group is freed but remains in the tree, leading to a use-after-free when the same MGID is later looked up.

In the Linux kernel RDMA/core subsystem, ib_get_eth_speed() does not check the registration state of the net_device before invoking the ethtool callback, which can lead to use-after-free during interface unregistration. The fix adds a NETREG_REGISTERED check under RTNL and returns -ENODEV for devices being unregistered.

A use-after-free vulnerability exists in the Linux kernel's IB/isert module. isert_send_done() defers completion handling for certain control PDUs to the isert_comp_wq workqueue, but nothing orders that work against connection teardown, so the queued work can run against memory freed by isert_wait_conn() and iscsit_close_connection().

In the Linux kernel wifi libipw subsystem, a vulnerability was fixed by rejecting too-short beacon and probe responses. Parsing functions assumed a full 36-byte prefix, but receive paths only guarantee a 24-byte header. Length calculation wrapped and caused out-of-bounds read.