CVE Vulnerability Catalog

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.

The Pods – Custom Content Types and Fields plugin for WordPress up to version 3.3.9 contains a privilege escalation vulnerability via authorization bypass. The pods_admin AJAX router funnels all access checks through pods_error(), which in the JSON meta-box-loader compatibility path only logs failures and returns false instead of terminating the request, rendering all guards ineffective. Unauthenticated attackers can escalate privileges to Administrator or overwrite any user's password, including the site owner's, enabling complete site takeover.

A vulnerability in Dancer2::Plugin::Auth::Extensible (through 0.713) for Perl allows password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Default emails emit a link with authority from the Host header or X-Forwarded-Host (under behind_proxy). An unauthenticated POST to /login with submit_reset and a username stores a fresh reset code and emails a link to a host chosen by the attacker. If the recipient follows the link, they hand a working reset code to the attacker's host, enabling account takeover.

In the Linux kernel, the iommu/arm-smmu-v3-iommufd subsystem has a vulnerability where arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID, assuming a device has exactly one stream. Devices with multiple streams get only the first one mapped, so vSID invalidations cannot reach the others' ATC and IOTLB entries; devices with none cause an out-of-bounds read. The fix adds an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one.

In the Linux kernel, the NTFS filesystem has a vulnerability related to unsafe size calculations during runlist reallocation. A shared helper was added to safely convert runlist element counts to byte sizes with overflow checks, used in ntfs_rl_realloc() and ntfs_rl_realloc_nofail().

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to an s16 overflow in the size change counter during NAT rewriting. A single SIP message can grow by more than 32767 bytes, causing the counter to wrap and leading to an out-of-bounds read (use-after-free).

In the Linux kernel's KVM/arm64 VGIC subsystem, a race condition exists between releasing an LPI structure and re-registering it. This can lead to deletion of a newly registered LPI from the xarray or to a memory leak of the old structure. The issue is triggered by guest operations such as DISCARD and MAPTI.

In the Linux kernel, the libiscsi_tcp module lacked a check on the data segment size in SCSI responses, which could lead to overflow of the conn->data buffer (8192 bytes) by a malicious iSCSI server. The vulnerability affects the ISCSI_OP_SCSI_CMD_RSP path, where the data segment (sense/response data) was copied without proper bounds.

In the Linux kernel, the rtase driver has a double free of multi-frag skb on DMA map failure. When the head buffer DMA mapping fails after fragments are mapped, the error path frees the skb twice, leading to a crash.

In the Linux kernel's SMB server (ksmbd), a vulnerability was found in the comparison of ClientGUIDs. ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. Using strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

A vulnerability in the Linux kernel's KVM for x86 was found, involving delayed EOI (End of Interrupt) processing by the I/O APIC. If the delayed EOI work is processed after vCPUs are destroyed, a use-after-free (UAF) occurs, potentially leading to system crash or code execution.

In the igbvf driver, there is a memory leak in TX DMA error cleanup. Due to an off-by-one error, if some mappings succeed and then an error occurs, one DMA mapping (the head) is not unmapped, causing a leak.

A use-after-free vulnerability was found in the Linux kernel's SMC network module during link group termination. The issue arises from insufficient socket protection against concurrent close, potentially leading to memory corruption.

In the Linux kernel, the bridge module has a bug in br_multicast_leave_group() that can lead to a use-after-free after deleting a port group during fast-leave multicast handling.

In the Linux kernel, the UML vector driver has a use-after-free bug in vector_mmsg_rx() when a packet with an invalid header is discarded. The freed skb remains in the buffer, leading to double-free and potential exploitation.

In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.