CVE Vulnerability Catalog

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.

IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users.

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system.

The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada theme. Allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. Affects versions before 7.13.2.

A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.

In the Linux kernel netfilter subsystem, a vulnerability in ctnetlink allowed accepting invalid values for TCP protocol attributes, potentially causing undefined behavior when used as shift counts. The fix replaces manual range and mask validations with netlink policy annotations, rejecting invalid values early.

In the Linux kernel, a vulnerability was found in softleaf_to_folio() in mm/huge_memory.c. Missing memory barrier (smp_rmb) causes a race condition between folio splitting and zap_nonpresent_ptes(), leading to VM_WARN_ON_ONCE or BUG_ON.

W jądrze Linuxa zidentyfikowano podatność, która pozwala na dereferencję wskaźnika NULL w przypadku, gdy użytkownik z uprawnieniami ustawi nr_contexts na 0 podczas działania DAMON. Problem występuje, gdy nie sprawdzono, czy kdamond->contexts->nr == 1 przed dostępem do contexts_arr[0].

W jądrze Linuxa zidentyfikowano podatność, która została rozwiązana. Funkcja damon_sysfs_repeat_call_fn() wywołuje inne funkcje bez sprawdzenia wartości contexts->nr, co może prowadzić do dereferencji wskaźnika NULL, jeśli nr_contexts jest ustawione na 0.

A vulnerability has been identified in the Linux kernel that occurs during the splitting of a PUD entry in the walk_pud_range() function. It may lead to a kernel bug when a thread attempts to read the numa_maps of a process while VFIO-PCI is setting up DMA.

In the Linux kernel, the ext4 filesystem replaces BUG_ON() with proper error handling in ext4_read_inline_folio. When inline data size exceeds PAGE_SIZE, instead of kernel panic, an error is logged, buffer head is released, and -EFSCORRUPTED is returned.

A memory leak vulnerability was found in the Linux kernel's idxd driver during workqueue reset. The issue occurs because the workqueue type is set to NONE before its resources are released.