CVE Vulnerability Catalog

The freo2 product by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges may upload an executable file and execute arbitrary OS commands.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI, any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legitimate library, the malicious code is loaded and executed under the security privileges of the GV-ASManager process.

In the Linux kernel's rhashtable library, there is a use-after-free vulnerability during table restart. When the table is freed during resize, the iterator does not clear iter->p, leading to a dereference of freed memory in rhashtable_walk_next(). This affects netlink_diag and TIPC.

In the Linux kernel, KVM nVMX has a vulnerability where the shadow VMCS is freed while vmcs01 still points to it. Due to asynchronous VMCLEAR, the vCPU may migrate before the pointer is cleared, leading to VMCLEAR on freed memory. The fix hides the shadow VMCS only after explicit VMCLEAR completes.

In the Linux kernel, KVM x86 has an issue where the check for invalid/obsolete root occurs before making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, KVM may map memory into an invalid root, violating the invariant that invalid pages are never on the active MMU list. The fix moves the check after making MMU pages available.

The Create Block WordPress plugin before version 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator to inject and execute arbitrary PHP code on the server.

LINE Android app prior to version 26.7.2 has a code injection vulnerability in the profile rendering component. The component does not adequately validate or sandbox externally supplied script content in profile templates, allowing an attacker to execute code with the app's privileges when a victim views the profile. A server-side mitigation has been deployed that also protects existing clients.

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the load_layer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

In Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firmware, there is a path traversal vulnerability in the CLI command used to execute configuration files. An authenticated attacker with administrator privileges can execute a crafted malicious configuration file on the device.

In Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0, a post-authentication command injection vulnerability exists in the "export-cgi" CGI program. An authenticated attacker with administrator privileges can execute OS commands on the device.

A vulnerability in Node.js HTTP/2 handling allows retained header blocks to bypass maxSessionMemory, potentially leading to remote memory exhaustion. Affects Node.js versions 24.x and 22.x.

In an application with CustomSounds storage configured to FileSystem, there is an unauthenticated path traversal (LFI) vulnerability under /custom-sounds/. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Microsoft Edge (Chromium-based) has an origin validation error that allows an unauthorized attacker to perform spoofing over a network.

In Microsoft Edge (Chromium-based), a type confusion vulnerability allows an unauthorized attacker to execute code over a network.

An origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

In Microsoft Edge for Android, a vulnerability involving external control of file name or path allows an unauthorized attacker to disclose information locally.

In Microsoft Edge for Android, an external control of file name or path vulnerability allows an unauthorized attacker to disclose information over a network.

A use-after-free vulnerability was found in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network.