CVE Vulnerability Catalog

A vulnerability was identified in the Linux kernel within the gfs2 filesystem, leading to a use-after-free error due to improper management of quota data objects. This issue occurred during filesystem shutdown when quota objects were removed from the LRU list but not correctly removed from it.

A vulnerability in the Linux kernel's netfilter module has been resolved regarding the connection clean-up limit. Fixes have been implemented to increase the clean-up limit to 64 connections and optimize the process of collecting unused connections.

A vulnerability in the Linux kernel has been resolved in netfilter, which caused packets to be dropped instead of queued when an application did not set the 'F_GSO' flag and received a GSO packet with an unconfirmed nf_conn entry.

A vulnerability has been identified in the Linux kernel in the ib_uverbs_post_send() function, which does not validate the wqe_size value before use. This allows reading beyond the allocated buffer, potentially leaking sensitive kernel information.

A vulnerability has been identified in the Linux kernel in the amdgpu_gmc_get_nps_memranges() function, which uses kfree() to free memory allocated by vmalloc(). This may lead to memory corruption.

In the Linux kernel, a double free vulnerability was found in the RDMA/rxe driver's rxe_srq_from_init function. The queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space, and if copy_to_user() fails, a second rxe_queue_cleanup() is triggered, causing a double free.

A vulnerability has been identified in the Linux kernel within the reserve_unaccepted() function, which incorrectly calculates the memory reservation size for the unaccepted memory table. This issue can lead to the table being overwritten or inaccessible, resulting in a kernel panic.

Usługa replikacji IBM Netezza Performance Server w wersjach 3.0.2.0 do 3.0.5.0 pozwala atakującemu z niskimi uprawnieniami na eskalację uprawnień do poziomu roota. Wykorzystując tę lukę, atakujący może wykonywać polecenia na poziomie roota, uzyskać dostęp do powłoki roota oraz zmienić hasło użytkownika root.

IBM InfoSphere Optim Test Data Fabrication w wersjach 1.0.0 do 1.0.2.7 może umożliwić zdalnemu atakującemu przechodzenie przez katalogi w systemie. Atakujący może wysłać specjalnie skonstruowane żądanie URL zawierające sekwencje 'kropka kropka' (/../), co pozwala na przeglądanie dowolnych plików w systemie.

Tasmota versions up to 15.3.0.3 contain an issue in the fetch_jpg() function that allows a remote attacker to cause a heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16_t variable, leading to allocation of a smaller buffer than the data actually read when the value exceeds 65535.

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_scripter.ino, fetch_jpg(), jpg_task.boundary[40], strcpy() function.

A Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and earlier allows a remote attacker to execute arbitrary code via the fetch_jpg() function in tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino.

Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection in the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the OS shell without sanitization, allowing an attacker to achieve remote code execution.

Netis AC1200 Router NC21 version V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON response with no authentication required. Any attacker on the LAN can send a single HTTP GET request and instantly retrieve administrator credentials and passwords.

The Netis AC1200 Router NC21 firmware version V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The root account password is set to the trivially weak value 'root', allowing an attacker with device access to authenticate as root and gain full control of the underlying operating system.

Picoclaw w wersji 0.1.2 i wcześniejszych jest podatny na wstrzyknięcie poleceń systemowych poprzez komponent ExecTool. Funkcja guardCommand() próbuje ograniczyć wykonywanie poleceń powłoki za pomocą listy zablokowanych wyrażeń regularnych, jednak lista ta jest niekompletna.

Biblioteka @pensar/apex w wersjach do 0.0.58 jest podatna na wstrzykiwanie poleceń systemowych za pomocą narzędzia smart_enumerate. Funkcja createSmartEnumerateTool() w pliku src/core/agent/tools.ts tworzy polecenie powłoki, łącząc niesanitizowane wartości z tablicy extensions oraz parametru url, co prowadzi do wykonania dowolnych poleceń systemowych.

In Slican telephone exchanges, the secure key is generated in a predictable manner, allowing an unauthenticated attacker to deduce it and obtain admin credentials.

A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports.

IBM Db2 w wersjach od 11.5.0 do 11.5.9 oraz od 12.1.0 do 12.1.4 jest podatny na atak typu denial of service przy użyciu specjalnie skonstruowanego zapytania, gdy włączone są transakcje autonomiczne.