CVE Vulnerability Catalog

In the Linux kernel SMB client, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual server reply length when snapshot_array_size is smaller than GMT_TOKEN_SIZE. A short reply makes ret_data_len exceed retbuf size, and the subsequent copy_to_user() reads past the end of the buffer.

In the Linux kernel SMB client, cifs_query_reparse_point() only checks that the start pointer is within the response (start >= end) but does not verify there is enough space for the fixed 8-byte header of the reparse_data_buffer structure. If a server provides a DataOffset leaving less than 8 bytes, reads of ReparseTag and ReparseDataLength occur out-of-bounds.

In the Linux kernel SMB client, receive_encrypted_standard() leaves server->total_read at the full decrypted frame size while walking sub-PDUs of a compound encrypted frame. This causes cifs_handle_standard() to pass the full size to smb2_check_message(), allowing truncated non-last sub-PDUs to bypass length validation and leading to out-of-bounds reads in smb2_get_data_area_len().

A vulnerability in the Linux kernel's DRM/TTM subsystem causes swapped-out resources to remain in their bulk_move range, leading to a use-after-free and system crashes. The bug manifests after hibernation or during process exit/reboot.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority and contains no vulnerability description.

The vulnerability allows an unauthenticated attacker to bypass the login lockdown mechanism in versions up to and including 2.17.

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation. This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

The BEAR plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can gain unauthorized access to functions or data.

The cloak library from version 0.1.0-pre is vulnerable to bit-flipping attacks on encrypted data. AES-256 encryption in CTR mode lacks integrity checking (MAC), allowing an attacker with write access to the encrypted store to modify data so that it decrypts to a chosen value.

The Fluent Forms Pro Add On Pack plugin versions up to 6.2.13 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. This means an attacker without logging in can inject malicious scripts into the page.

The vulnerability in cloak_ecto and cloak libraries involves using a password hash with insufficient computational effort. An attacker who holds hashed values and the configured secret can brute-force low-entropy plaintexts much faster than configured.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive.

The Progress Planner plugin versions up to 1.10.0 contain a Broken Access Control vulnerability from the subscriber role. This means a low-privileged user can gain unauthorized access to functions or data.

The eLoanApp application contains a SQL injection vulnerability in the POST parameter 'logina' in the endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection.

The Sermon'e plugin versions up to 1.0.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.

The PublishPress Capabilities plugin (capability-manager-enhanced) versions up to 2.45.0 contain an Incorrect Privilege Assignment vulnerability that allows privilege escalation. This means a user can gain higher privileges than intended.

Missing Authorization vulnerability in Easy Digital Downloads allows exploiting incorrectly configured access control security levels. Affects versions through 3.7.1.

The vulnerability allows an unauthenticated attacker to change settings in the PayPlug for WooCommerce (Official) plugin in versions up to and including 3.1.0.

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.4.6 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into the page.

The WooCommerce Simple Auctions plugin in versions up to and including 3.0.10 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw allows injection of malicious JavaScript into site pages.