CVE Vulnerability Catalog

In the Linux kernel's libceph module, after an authorizer update, the auth->authorizer_buf may point to freed memory, leading to a use-after-free. The fix refreshes these pointers after a successful authorizer rebuild.

In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.

In the Linux kernel's phonet module (PEP subsystem), the function pep_get_sb() does not consider that pskb_may_pull() might have relocated the skb data, and continues to access the older pointer, leading to a use-after-free. The issue was confirmed by KASAN.

In the Linux kernel's net/x25 subsystem, there is a use-after-free vulnerability in x25_kill_by_neigh(). The function walks the global X.25 socket list but does not pin the socket's lifetime after dropping the list lock. A concurrent close can free the socket, and the function then uses the freed object. The fix takes a reference with sock_hold() and rechecks the connection.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism allows re-aggregation of packets marked with the flush flag. The lack of validation in skb_gro_receive_list() leads to corruption of the frag_list chain, potentially causing a kernel panic during packet transmission.

In the Linux kernel ILA module, after calling pskb_may_pull(), the IPv6 header pointer may become stale, leading to use-after-free. The fix reloads the pointer after each pskb_may_pull().

A vulnerability in the Linux kernel's MCTP serial driver allows zero-length frames to bypass validation and cause out-of-bounds writes. An attacker with CAP_NET_ADMIN can trigger a buffer overflow via the tty receive path.

In the Linux kernel openvswitch module, during GSO segmentation for userspace actions, a length underflow can occur, leading to incorrect skb_zerocopy() behavior. The fix stores the maximum preserved length and bounds consumers.

In the Linux kernel, the tipc_sk_create() function fails to clear sock->sk on the failed-insert path, leading to a use-after-free in the accept() path. The issue occurs when the socket hash table reaches its maximum size (about 2 million sockets per network namespace).

Zyxel Networks WAH7601 through 20072026 has an OS command injection vulnerability that allows an attacker to execute arbitrary commands on the system.

In the Linux kernel, the ksmbd (SMB) server has a vulnerability in path resolution in ksmbd_vfs_kern_path_create. An attacker can use '..' components to escape the shared resource, leading to privilege escalation or unauthorized access.

phpfm through 1.8.0 has a missing authentication vulnerability that allows an unauthenticated remote attacker to access the full file manager functionality, including reading, writing, deleting, and uploading files anywhere on the server filesystem.

phpfm through 1.8.0 has an unrestricted file upload vulnerability that allows an unauthenticated attacker to upload a PHP webshell and execute it on the server. The application has no authentication by default and an empty upload extension filter.

crontab-ui through 0.4.2 has an OS command injection vulnerability that allows an unauthenticated attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

crontab-ui through 0.4.2 has an OS command injection vulnerability that allows an unauthenticated attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

NASA fprime-gds through 3.4.3 has multiple vulnerabilities that allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application applies no authentication to any endpoint.

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The wiki-cache endpoint constructs file paths from user-controlled fields without sanitization, enabling path traversal.