CVE Vulnerability Catalog

The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

GitLab EE contains a vulnerability that allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials. The attacker uses a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

In the Linux kernel, nfsd_setattr() checked the NFSD_MAY_TRUNC permission using a file size sampled without the inode lock, while the actual size update was applied later under inode_lock(). This created a TOCTOU window for append-only files where a concurrent append could extend the file before a real truncation was applied without the required check.

In the Linux kernel, nfsd4_ssc_expire_umount() walked nfsd_ssc_mount_list while dropping nfsd_ssc_lock for mntput(), but kept the tmp pointer saved by list_for_each_entry_safe. Another NFSD thread could delete and free the item that was the saved tmp during that window, leading to a use-after-free.

A use-after-free vulnerability was fixed in the Linux kernel's nfsd (NFS server) module. After a DESTROY_SESSION, the rpciod thread could still dereference the freed session structure via the cl_cb_session pointer, leading to access of freed memory. The fix converts cl_cb_session to an RCU-protected pointer and changes session freeing from kfree() to kfree_rcu().

In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().

A vulnerability was fixed in the Linux kernel's nfsd subsystem affecting the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. The server sockaddr slot in the trace buffer was sized by xpt_remotelen but filled with data of length xpt_locallen, so when xpt_locallen exceeded xpt_remotelen, the memcpy wrote past the reserved ring-buffer slot. The issue is reachable for NFSv2/v3 requests over UDP, where xpt_remotelen remains 0 for the transport's lifetime.

In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.

A use-after-free vulnerability was found in the Linux kernel nfsd module within nfsd4_sequence(). When the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs, free_session_slots() may free the slot currently being processed because it does not check seq->slotid or the NFSD4_SLOT_INUSE flag. This leads to memory corruption via writes into the freed sl_data[] buffer.

In the Linux kernel's nfsd module, nfs4_preprocess_seqid_op() on an -EAGAIN error from nfsd4_cstate_assign_replay() dropped a stateowner reference it never acquired, while leaking the stid reference. This risks a stateowner refcount underflow and use-after-free, and can stall a concurrent nfsd4_close_open_stateid(). The fix drops the stid reference before retrying.

In the Linux kernel, nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering BUG_ON. The race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall.

In the Linux kernel, the workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.

In the Linux kernel, nfsd4_create_file() may call fh_compose() with the wrong dentry. dentry_create() can hypothetically return a different dentry than the one passed in, potentially leading to a use-after-free. The fix moves the fh_compose() call until the final dentry is certain.

In the Linux kernel, nfsd4_copy() for async COPY has an initialization order bug. nfs4_init_copy_state() is called before dup_copy_fields(), so the s2s_cp_stateids IDR entry points to the COMPOUND buffer memory that is reused by the next request. This can lead to use-after-free or memory corruption, causing kernel crashes or potential code execution.

A use-after-free (UAF) vulnerability was fixed in the Linux kernel's NFS asynchronous copy mechanism (nfsd). A race between the copy kthread and teardown callers (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) could free or use an already-freed copy structure, double-put nfsd_file, and dereference a freed task_struct.

In the Linux kernel, nfsd4_ff_encode_layoutget() has multiple XDR buffer size calculation errors. These errors can result in an out-of-bounds write or leaking uninitialized kernel memory to the client. The worst case occurs with short strings, where the function writes up to 5 bytes past the reserved XDR buffer.

In the Linux kernel, nfsacld_proc_setacl() for NFSACL v2 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the other pointer (acl_default) remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.