CVE Vulnerability Catalog

In the Linux kernel, smack_file_send_sigiotask() was accessing both tsk->cred and __task_cred(tsk). Accessing ->cred on a non-current task is forbidden because a task can change its own ->cred pointer without synchronization, leading to a use-after-free of struct cred.

AirSane versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion. The HttpServer::Request::content function reads the Content-Length header and passes it directly to std::string::resize() without upper-bound validation, causing allocation of gigabytes of memory and process crash. Additionally, non-numeric characters in the Content-Length header lead to undefined behavior.

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

A heap-based buffer overflow in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp.

The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Sky Addons for Elementor plugin in versions up to and including 3.8.4 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Masteriyo - LMS plugin in versions up to and including 3.4.0 contains an Unauthenticated PHP Object Injection vulnerability. An attacker can inject a malicious PHP object, potentially leading to further attacks such as remote code execution.

The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.

The Gato GraphQL plugin in versions up to and including 19.2.3 contains a vulnerability allowing a subscriber to escalate their privileges. A low-privileged user can gain access to functionality reserved for higher roles.

The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.

A race condition in the document value layer of MongoDB Server allows concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user with ordinary read-write privileges on a database can trigger this condition over the normal client protocol.

In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.

A vulnerability in Apache OpenNLP (opennlp-spellcheck extension, versions 3.0.0-M4 and 3.0.0-M5) allows an Out-of-Memory Denial of Service. The SymSpellModelSerializer.create() method reads unigram and bigram count fields from a model file and passes them directly to map pre-sizing without an upper bound, causing a crafted .bin file to attempt a 4–8 GB allocation and fail with OutOfMemoryError.

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.