CVE Vulnerability Catalog

A SQL injection vulnerability was discovered in CRMEB up to version 5.6 in the file /adminapi/product/product of the GET Parameter Handler component. Manipulation of the cate_id argument leads to SQL injection. The exploit has been publicly disclosed and can be used remotely.

In samanhappy MCPHub up to version 0.9.10, there is a server-side request forgery (SSRF) vulnerability in the file src/controllers/serverController.ts of the MCPRouter Service component, caused by manipulation of the baseUrl argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in MCPHub up to 0.9.10, involving OS command injection in src/controllers/serverController.ts. Manipulation of command/args allows remote code execution. The exploit is public and may be used.

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. It affects unknown processing in the Add Work Item Page component, where manipulation of the Title argument results in CSV injection. The attack can be launched remotely, and the exploit is now public.

A cross-site scripting vulnerability has been detected in AllStarLink Supermon up to version 6.2, affecting the AllMon2 component. The attack can be initiated remotely, and the exploit has been publicly disclosed. The product is no longer supported by the maintainer.

A vulnerability in Assimp 6.0.2 in the Q3DImporter::InternReadFile function leads to a heap-based buffer overflow. The attack requires local access, and the exploit is publicly available.

A vulnerability in Assimp 6.0.2 in the ODDLParser::getNextSeparator function leads to a heap-based buffer overflow. The attack requires local access, and the exploit is publicly available.

In LaChatterie Verger up to version 1.2.10, a vulnerability exists in the redirectToAuthorization function of the file /src/main/services/mcp/oauth/provider.ts. Manipulation of the argument URL results in deserialization. The attack can be executed remotely, and the exploit has been made public. The vendor was contacted but did not respond.

A vulnerability in SeriaWei ZKEACMS up to 4.3 affects the Delete function in src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the POST Request Handler component. The manipulation leads to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.

In the Linux kernel, the wifi: rtw88 driver fails to delete the TX purge timer and free the C2H queue when unloading, which can cause a crash or memory leak on driver unload.

In the Linux kernel, a vulnerability in the Btrfs filesystem related to the 'push_node_left' operation fails to log a move operation in the tree mod log. This can lead to a race condition during tree mod log rewind, potentially causing a kernel NULL pointer dereference and a system panic.

In the Linux kernel, a potential memory leak was found in the drm/amd driver. The issue occurs when the function returns NULL at the end, leaving allocated memory for clk_src unreleased. The fix replaces free with kfree.

A hung task vulnerability was found in the Linux kernel during LTP cgroup testing with repeated mount/unmount of perf_event and net_prio controllers. The issue occurs when work items are queued in a single cgroup_destroy_wq workqueue, causing a deadlock. The fix splits the workqueue into three dedicated ones: cgroup_offline_wq, cgroup_release_wq, and cgroup_free_wq.

A NULL pointer dereference vulnerability exists in the Linux kernel in tcp_ao_finish_connect() when connect() is called on a socket with a TCP-AO key added and TCP_REPAIR enabled. The function dereferences tcp_hdr(skb)->seq while skb is NULL, without prior validation. The fix adds a NULL check for skb before dereferencing.

In the Linux kernel, the mlx5_uplink_netdev_get() function in the net/mlx5e driver can retrieve a NULL uplink netdevice pointer if the device is unbound from the mlx5_core.eth driver. This leads to a NULL pointer dereference and kernel panic.

W jądrze Linuxa zidentyfikowano podatność związaną z możliwym przepełnieniem całkowitym w funkcji stripe_io_hints, które może wystąpić przy zbyt dużym rozmiarze fragmentu. Problem został rozwiązany poprzez wprowadzenie testu na przepełnienie, aby nie ustawiać wartości limits->io_min i limits->io_opt w przypadku jego wystąpienia.

In the Linux kernel ASoC qcom q6apm-lpass-dais component, if opening the source graph fails, the graph pointer is set to NULL, and a subsequent call to q6apm_lpass_dai_prepare() dereferences NULL. This can cause a NULL pointer exception and kernel crash.

In the Linux kernel rfkill-gpio driver, rfkill_find_type() is called with an uninitialized type_name variable when a BCM4752 or LNV4752 ACPI device lacks the "type" property. This can lead to a potential crash.

In the Linux kernel's CCP driver (crypto: ccp), a NULL pointer dereference vulnerability occurs when __sev_platform_shutdown_locked() is called with a NULL argument. This issue manifests on the shutdown path during suspend to disk, causing an Oops error and potential system crash.

In the Linux kernel drm bridge anx7625 driver, if an interrupt occurs before resource initialization completes, the interrupt handler may access uninitialized data such as the I2C tcpc_client device. This can lead to a NULL pointer dereference.