CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel that leads to a leak of the active connection count on transport allocation failure in the ksmbd_tcp_new_connection() function. This issue can be exploited by an unauthenticated remote attacker to induce memory pressure, resulting in the rejection of all subsequent connection attempts.

In the Linux kernel, a vulnerability was found in the CIFS implementation where build_sec_desc() and id_mode_to_cifs_acl() improperly validate the DACL structure from the server. A malicious server can supply a truncated DACL with a fake ACE count, causing an out-of-bounds read during security descriptor rewrite.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_ioctl_query_info function. The issue arises when a server returns a buffer length greater than the actual QUERY_INFO response, potentially exposing kernel memory to userspace.

In the Linux kernel, a use-after-free vulnerability exists in inode_switch_wbs_work_fn() in the writeback mechanism. The processing loop can cause a wb object to be freed while a pending work item still exists, leading to use-after-free.

W jądrze systemu Linux zidentyfikowano podatność polegającą na błędzie use-after-free w funkcji f2fs_compress_write_end_io(). Problem ten występuje w wyniku nieprawidłowego zarządzania licznikami stron, co prowadzi do zniszczenia pamięci, która jest nadal używana przez inne operacje.

A vulnerability has been identified in the Linux kernel in the tpacket_snd() function, allowing for a TOCTOU race condition using mmap'd vnet_hdr. As a result, a user-space thread can modify vnet_hdr fields between validation and use, bypassing all safety checks.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem dotyczy próby kopiowania CSR do przestrzeni użytkownika, gdy polecenie PSP zakończyło się niepowodzeniem, co może prowadzić do przepełnienia bufora i wycieku danych.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem polegał na próbie skopiowania certyfikatu PDH do przestrzeni użytkownika, gdy polecenie PSP zakończyło się niepowodzeniem, co mogło prowadzić do przepełnienia bufora i wycieku danych.

W jądrze systemu Linux zidentyfikowano podatność, która została rozwiązana. Problem występuje podczas próby skopiowania identyfikatora CPU do przestrzeni użytkownika, gdy polecenie firmware'u zakończyło się niepowodzeniem, co może prowadzić do przepełnienia bufora i wycieku danych.

W jądrze Linuxa zidentyfikowano podatność związaną z brakiem walidacji długości biletu w nie-XDR przygotowaniu klucza. W ścieżce nie-XDR, która obsługuje ładunki o długości do 28 bajtów, nie sprawdzano poprawności długości biletu, co mogło prowadzić do przekroczenia maksymalnej długości tokenu.

In the Linux kernel FUSE filesystem, a vulnerability exists due to missing validation of directory entry (dirent) size before copying into the page cache. A malicious FUSE server can send a dirent exceeding PAGE_SIZE, causing a buffer overflow during memcpy() that overwrites adjacent kernel pages.

A vulnerability has been detected in AstrBotDevs AstrBot up to version 4.16.0, affecting unknown processing of the file astrbot/dashboard/routes/auth.py in the Dashboard component. The manipulation leads to hard-coded credentials.

The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions, allowing unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code.

A vulnerability in OpenStack ironic-python-agent versions 1.0.0 through 11.5.0 allows code execution via a malicious partition image. IPA sometimes runs grub-install inside a chroot of the deployed image, leading to code execution.

In OpenStack Keystone before version 29.0.2, the POST /v3/credentials endpoint did not validate that the caller-supplied project_id for an EC2 credential matched the project of the authenticating application credential. An attacker with an unrestricted application credential for project A could create an EC2 credential targeting project B, then exchange it for a Keystone token scoped to project B while retaining the original app_cred_id.

Apache Neethi does not properly detect circular references in policy definitions. Circular references in WS-Policy documents can lead to an infinite loop or excessive recursion, resulting in a stack overflow or application hang.

Apache Neethi is vulnerable to a Denial of Service attack due to algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, leading to unbounded memory allocation and JVM heap exhaustion.

The LabOne Q serialization framework uses a class-loading mechanism to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from serialized data, allowing attackers to execute arbitrary code.

A vulnerability was identified in itsourcecode Electronic Judging System 1.0, affecting an unknown part of the file /intrams/login.php. Manipulation of the argument 'Username' leads to SQL injection.

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Manipulation of the argument ID in the file /ajax.php?action=save_customer leads to SQL injection.