CVE Vulnerability Catalog

In libkcapi, the one-shot AIO path can return an error before all IOCBs are drained, allowing the kernel to later write into caller-owned output buffers, causing memory corruption.

In @oblique/cli 15.4.0, an OS command injection vulnerability exists in the project creation functionality. The project name is concatenated into a shell command without proper neutralization, allowing execution of additional commands.

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability in rxe_mmap. The issue arises because the rxe_mmap_info structure is removed from the pending_mmaps list and the lock is released before remap_vmalloc_range completes, allowing a concurrent DESTROY_CQ ioctl to free memory during mapping. This can lead to a kernel crash (GPF) or a page-level use-after-free.

In Eclipse Theia up to 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints without confining to the workspace. In browser mode, the connection token is not enforced for HTTP requests, allowing unauthenticated clients to read any file readable by the backend process.

In Eclipse Mojarra versions 2.3 and later, URL handling in DefaultFaceletFactory does not block remote URLs, allowing an attacker to include a remote Facelet processed with server privileges.

Vulnerability in the wp-downloadmanager WordPress plugin (version 1.68.11 and 6.9.4 release line) allows an admin-privileged user to upload arbitrary files without any extension or MIME-type validation.

In toner-management, admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

The 'backmeup' npm package assembles shell command strings by directly concatenating option values and executes them via a shell, instead of using execFile/spawn with an argument array. This allows shell command injection.

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

In Book-Management-System, Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py, email_creators.py, and helpers.py.

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side. The Lua engine performs no input validation and preloads dangerous libraries enabling arbitrary code execution, DB access, file I/O, SSRF, and path traversal.

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

MacCMS10's admin template editor blocks dangerous PHP functions via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

In Eclipse Theia up to version 1.73.1, the @theia/filesystem backend exposes POST /file-upload, which takes an attacker-supplied absolute path and performs fs.move without workspace confinement or authentication. In browser deployments, the connection token is enforced only on WebSocket upgrades, and tokenless HTTP requests are not rejected, allowing unauthenticated arbitrary file write outside the workspace, potentially leading to remote code execution.

In Eclipse Theia versions 1.66.0 through 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint, which resolves file paths without verifying they stay within the plugin directory. An unauthenticated attacker can use percent-encoded '../' sequences to escape the directory and read arbitrary files accessible to the backend process.

NeuVector through 5.4.9 can potentially leak information from the manager /network/graph API due to missing authentication and cached data containing sensitive information.