CVE Vulnerability Catalog

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name, the argument string is concatenated with the command and passed to child_process.spawn with the shell: true option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host.

In the Linux kernel, the rockchip rkcif media driver fixed off-by-one errors that could cause out-of-bounds array access.

In the Linux kernel's 9p filesystem, a vulnerability was found where access mode flags are ORed instead of replaced. When mounting with 'access=user', both V9FS_ACCESS_CLIENT and V9FS_ACCESS_USER flags are set, preventing proper operation of privileged commands like chown.

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can read, write, or delete arbitrary files on the user's system. The vulnerability was confirmed in version v0.10.15, status of other versions is unknown.

In the Linux kernel, the greybus gb-beagleplay driver has a buffer overflow vulnerability in cc1352_bootloader_rx() due to missing bounds check before memcpy, which could lead to buffer overflow and potential code execution.

In the Linux kernel, TCP ULP support for SMC was reverted because the implementation violated VFS invariants, creating a risk of use-after-free and system instability.

In the Linux kernel, the AppArmor module fixed rlimit handling for POSIX CPU timers by conditionally updating the timers.

In the Linux kernel's device mapper, a vulnerability was found in the dm_blk_report_zones function, which checks the device's suspended state without holding a lock. The device could be suspended right after the check, leading to a race condition.

In the Linux kernel, in the MPRLS0025PA pressure driver (iio: pressure), the spi_transfer struct was not zeroed before use. This can lead to unpredictable behavior or errors during SPI communication.

In the Linux kernel, the netfilter nf_tables subsystem functions nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks did not use list_del_rcu() when removing elements from the netlink hooks list. Since this list can be concurrently traversed by dumpers, the lack of RCU synchronization could lead to a data race.

In the Linux kernel, a vulnerability in the GRO (Generic Receive Offload) mechanism allows merging zerocopy packets without checking the SKBFL_MANAGED_FRAG_REFS flag, potentially leading to use-after-free (UAF). The issue occurs when either the last packet in the GRO chain or the source packet is zerocopy.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() on build_skb() failure. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. Each failure in a batch leaks a page-frag chunk.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() when rejecting frames shorter than ETH_HLEN. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. A local attacker can exploit this to trigger an OOM panic.

In the Linux kernel, a memory leak occurs in tap_get_user_xdp() because pages are not freed on error paths, leading to page-frag leaks.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the net/sched: act_ct module during flow table lookup. The rhashtable_lookup_fast() function releases the RCU lock before incrementing the reference count, allowing concurrent freeing of the ct_ft object and leading to privilege escalation.

In the Linux kernel, KVM for ARM64 has a use-after-free vulnerability in the nested_mmus array. The array is reallocated without proper locking, which can lead to referencing freed memory by other threads.

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

The Mac Photo Gallery 3.0 WordPress plugin contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the albid parameter. Attackers can send requests to macdownload.php with directory traversal sequences to access sensitive files like wp-load.php outside the intended plugin directory.

The Apptha Slider Gallery plugin version 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.