CVE Vulnerability Catalog

W Keycloak, rozwiązaniu do zarządzania tożsamością i dostępem, znaleziono lukę. Gdy aplikacja kliencka jest skonfigurowana do akceptacji szerokich identyfikatorów URI, zdalny atakujący może manipulować procesem uwierzytelniania, tworząc specjalny adres internetowy.

In the Linux kernel, a vulnerability was found in the bareudp driver where the bareudp_fill_metadata_dst() function is called without checking if the socket exists. When the network device is down, the socket is NULL, leading to a NULL pointer dereference and system crash.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the TAPRIO network scheduler during class dump. Deleting a child qdisc via RTM_DELQDISC stores NULL in the q->qdiscs[] array, and a subsequent class dump operation (RTM_GETTCLASS) tries to read the handle from this NULL pointer, causing a kernel panic.

In the Linux kernel netfilter arp_tables subsystem, a vulnerability was found due to incorrect parsing of ARP packets for IEEE1394 (FireWire) interfaces. According to RFC 2734, ARP for IPv4-over-IEEE1394 omits the target hardware address field, causing the arp_packet_match() function to read wrong bytes when comparing addresses. This leads to incorrect filtering decisions – packets may be wrongly accepted or dropped. Additionally, mangling operations on these fields can cause packet corruption.

In the Linux kernel, a vulnerability was found in the SLIP protocol implementation. The slhc_init() function accepts 0 for the rslots parameter, leaving the rstate array NULL. When a VJ (Van Jacobson) packet with an explicit connection ID is received, the slhc_uncompress() and slhc_remember() functions attempt to access this array, causing a NULL pointer dereference and kernel panic.

In the Linux kernel, a divide-by-zero vulnerability was found in the nfnetlink_osf module. A user with CAP_NET_ADMIN privileges can add a crafted TCP fingerprint with wss.val set to 0, causing a kernel panic when matching a SYN packet.

In the Linux kernel, a vulnerability in openvswitch allows a CAP_NET_ADMIN user to install an oversized upcall PID array, causing a reply buffer overflow and triggering BUG_ON, resulting in a kernel panic. This is reachable via unprivileged user namespaces (e.g., Ubuntu default).

In the Linux kernel, a vulnerability was found in the cgroup_storage_get_next_key() function in the BPF mechanism. The list_next_entry() function never returns NULL, making the NULL check dead code, and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer aliasing internal map fields and copying the result to userspace.

The Booking Manager plugin (through 2.1.18) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.

The WPComplete plugin (through 2.9.5.4) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.

The Ads by WPQuads plugin contains an Improper Validation of Specified Quantity in Input vulnerability that allows manipulating hidden fields. The issue affects versions up to and including 3.0.2.

The AWP Classifieds plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.4.5.

The Checkout Files Upload for WooCommerce plugin (versions up to and including 2.2.5) contains an authorization bypass through a user-controlled key vulnerability. This is due to incorrectly configured access control security levels.

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

The Averta Master Slider plugin in versions up to and including 3.10.8 contains an improper neutralization of input during web page generation vulnerability. This may lead to DOM-based cross-site scripting.

The WordPress GenerateBlocks plugin in versions up to 2.1.0 contains an insertion of sensitive information into sent data vulnerability. This may allow an attacker to retrieve embedded sensitive data.

A SQL Injection vulnerability in the user_alarmprofile view arises from improper neutralization of special elements in a SQL SELECT command. A low privileged remote attacker can read the entire database.

A SQL Injection vulnerability in the tag view arises from improper neutralization of special elements in a SQL SELECT command. A low privileged remote attacker can read the entire database.

A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.