CVE Vulnerability Catalog

In openGauss-connector-jdbc's LogFactory.java, LogFactory loads the logger class name from JDBC connection parameters via Class.forName, then directly invokes the String constructor and casts to Log. Missing asSubclass(Log.class) validation causes non-Log classes to be instantiated before type checking. When an attacker controls the logger class name in the JDBC URL or connection properties and a loadable class exists on the client classpath, unexpected class loading and constructor side effects may be triggered on the client.

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs of the Catalog API component. The manipulation leads to improper authentication, and the attack can be initiated remotely. The project was informed but has not responded.

In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.

A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.

A weakness has been identified in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) in App/Home/Controller/UserController.class.php of the Captcha Validation component. The manipulation leads to improper access controls, the attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.

In the Linux kernel, llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() called kfree_skb(skb) instead of kfree_skb(nskb) on llc_mac_hdr_init() failure, leaking the newly allocated nskb, reading from freed skb, and double-freeing skb. Similar nskb leaks occurred in llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(). The fix frees nskb in all three error paths.

A vulnerability in the Linux kernel's TIPC module was fixed where invalid or unexpected GRP_ACK_MSG messages could cause an underflow of the bc_ackers counter. Because the counter is a u16, it could wrap to 65535, permanently blocking group broadcasts on the socket.

In the Linux kernel, bpf_lsm_has_d_inode_locked() caused the verifier to rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants that assume the inode's i_rwsem is held. However, the path_unlink and path_rmdir hooks run before vfs_unlink()/vfs_rmdir() take that lock, so a BPF LSM program attached to these hooks mutates xattrs without holding the lock.

In the Linux kernel, ipv6_find_hdr() walked the IPv6 extension header chain without verifying that the computed offset stayed within the packet bounds. openvswitch then installed that offset as the transport header, and update_ipv6_checksum() read and wrote the transport checksum field out of bounds, causing a KASAN-reported use-after-free. The fix rejects any header whose declared length does not fit within the packet.

In the Linux kernel, the rds: ib subsystem's rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping succeeds. On failure, __rds_rdma_map() unpins pages and frees the scatterlist, but rds_ib_free_frmr() can return the MR to the pool with a stale pointer, leading to use-after-free and local privilege escalation.

In the Linux kernel, the kfd_dev_mapping function (drm/amdkfd driver) had two bugs: a use-after-free leading to an i_mmap_rwsem deadlock, and a multi-container gap where VMAs from later /dev/kfd openers were never unmapped. Both manifest under SRIOV with multiple containers and can cause a hard hang or leave stale doorbell/MMIO mappings. The fix creates a private pseudo-filesystem and redirects all openers to a single anonymous inode.

In the Linux kernel, the drm/nouveau/dmem module's nouveau_dmem_chunk_alloc() registers a region of DMEM_CHUNK_SIZE * NR_CHUNKS, but the backing VRAM buffer object remains DMEM_CHUNK_SIZE. As a result, pages beyond the first chunk resolve to VRAM outside the buffer, causing invalid memory access.

A use-after-free vulnerability exists in the Linux kernel's drm/nouveau/uvmm module. The nouveau_uvmm_sm() function calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(), and nouveau_uvmm_vmm_map() then reads mem->mem.type. When the BO remains in TTM_PL_SYSTEM, bo->resource points only to a struct ttm_resource, so reading mem->mem.type goes past the end of the resource, triggering a KASAN slab-use-after-free.

A double-free vulnerability exists in the nouveau driver of the Linux kernel within the nvif_vmm_dtor function. When nouveau_cli_init() fails, nouveau_cli_fini() is called twice, and since vmm->page is not cleared after being freed, the second call causes a double-free.

In the Linux kernel, struct nouveau_sched embeds a drm_gpu_scheduler, and nouveau_sched_destroy() frees it with kfree() after drm_sched_fini(). Because fences exported to userspace via drm_syncobj/sync_file still point to the freed memory, a later get_timeline_name() call causes a use-after-free (KASAN slab-use-after-free read).

In the Linux kernel, xe_vm_close_and_put() destroyed vm->pt_root (via xe_vm_pt_destroy()) before processing contested VMAs that were still linked to their buffer objects. If a concurrent thread evicts one of those shared buffers, xe_bo_trigger_rebind() walks the BO's VMAs and calls xe_pt_zap_ptes(), where dereferencing pt->level causes a NULL pointer dereference because vm->pt_root[tile->id] is already NULL.

The Linux kernel has a missing memory barrier between anon_vma initialization and the publication of vma->anon_vma. As a result, two threads handling adjacent VMAs can concurrently call __anon_vma_prepare(), leading to a use-after-free (UAF) and a deadlock on the anon_vma->root->rwsem lock. This manifests as a hung task on arm64 platforms.

In the Linux kernel, alps_input_configured() in the HID alps driver stores data->input2 before registering the input device. If registration fails, input_free_device() frees the memory but data->input2 still points to it, and with active URBs this can lead to a use-after-free.