CVE Vulnerability Catalog

In the Linux kernel, BPF for TCP has a double socket release issue during batch realloc in bpf_iter_tcp_batch(). On realloc failure, the function returns an error but leaves cur_sk/end_sk stale, leading to a second call to bpf_iter_tcp_put_batch() and dereferencing a cookie as a sock pointer. The fix empties the batch on the failure path to avoid double release.

In the Linux kernel's mac80211 subsystem, a use-after-free vulnerability exists during WiFi link updates. When drv_change_vif_links() fails, newly created debugfs entries are not removed, leaving dangling pointers to freed memory. A subsequent read of these files (e.g., link-1/txpower) can trigger memory corruption and kernel panic.

In the Linux kernel, in ieee80211_set_fils_discovery(), the old template is freed via kfree_rcu() before allocating the replacement. If the allocation fails, the function returns -ENOMEM while the pointer still points to the object already queued for freeing, leading to a double-free on later update or AP teardown. The fix is to queue the old object for kfree_rcu() only after the new one is published.

In the Linux kernel's mac80211 subsystem, there is a double-free vulnerability in ieee80211_set_unsol_bcast_probe_resp(). When allocation of a new template fails, the old object is already queued for freeing while the pointer still references it, leading to a second free and a KASAN error.

In the Linux kernel, a vulnerability in Btrfs free space cache (v1) lacks validation of entry counts in the on-disk header. Loading a crafted cache with excessive entries can cause an out-of-bounds read past the allocated pages array, leading to memory corruption and potential general protection fault.

A Memory Allocation with Excessive Size Value vulnerability in Apache Lucy affects all versions. As the project is retired, no fix will be released.

Apache Lucy (retired project) has an uncontrolled recursion vulnerability in all versions. The project is no longer supported, so no fix will be released. Users are advised to find an alternative or restrict access to trusted users.

When API audit logging is enabled in Rancher Manager, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier than APIBodyLimitingHandler, the body-size cap is bypassed. An unauthenticated attacker can send arbitrarily large request bodies to public login endpoints, causing memory exhaustion and termination of the Rancher Manager process.

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one through the Rancher API, etcd, stored automation, or direct file access on a node, and use it at any time to register a rogue node into the cluster.

Crater isolates data per company_id, but CustomerPolicy's view/update/delete methods omit the company-ownership check, and route-model-bound customer lookups and bulk delete are unscoped, allowing cross-company access.

Leantime through 3.6.2 exposes JSON-RPC methods for TwoFA that act on a caller-supplied userId without ownership check, session pinning, or permission-attribute gate.

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php, checked against the last 4-5 characters of the filename.

The TableOn – WordPress Posts Table Filterable plugin for WordPress up to version 1.0.5.1 is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action. The value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The Page and Post Restriction plugin for WordPress up to version 1.4.0 is vulnerable to Sensitive Information Exposure via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. The plugin's REST guards source their restricted-ID list exclusively from per-page metabox options, ignoring the global toggles 'Make all Pages Private' and 'Make all Posts Private'. Unauthenticated attackers can read the full rendered content of every published page and post, bypassing the frontend security boundary.

Vulnerability in HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

A vulnerability in HashBrown CMS (up to version 1.4.6) allows OS command injection (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

In Apache Qpid ProtonJ2 through 1.1.0, it was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. Affects Apache Qpid ProtonJ2 through 1.1.0.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.