CVE Vulnerability Catalog

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only checks that paths do not begin with "/" but fails to block sequences like "../". An authenticated administrator can craft a relative_path containing traversal sequences, allowing arbitrary file write to any location writable by the Pulp service user.

A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.

A heap-based buffer overflow in FreeRDP before version 3.28.0 (affected <=3.27.1) in the crypto_rsa_common() function. The function writes the modular exponentiation result to the output buffer before checking bounds, allowing out-of-bounds writes.

Vulnerability in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert, so client certificates were not validated. A remote attacker can connect as an unauthenticated agent and intercept control-plane-to-node traffic.

Vulnerability in Crypt::Password for Perl up to version 0.28 causes generation of insecure, predictable salt values using the built-in rand function, which is unsuitable for cryptographic purposes.

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

The Meshtastic GitHub repository before version 2.7.21.1370b23 has a vulnerability in the main_matrix.yml workflow triggered by pull_request_target. Multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" automatically triggered CI. The workflow directly executes attacker-controlled files from the fork checkout. This could lead to supply chain compromise, runner compromise, or repository takeover. The fix is in version 2.7.21.1370b23.

In the Linux kernel, the idpf driver has a bug in idpf_ptp_init() where the read_dev_clk_lock spinlock is initialized after the PTP auxiliary worker is scheduled, which can immediately try to acquire the lock, causing a lockdep warning about registering a non-static key.

In the Linux kernel, a vulnerability was found in the netfs mechanism, involving potential tearing when reading and writing the ->remote_i_size and ->zero_point fields. The issue stems from insufficient synchronization, which could lead to data corruption.

In the Linux kernel, a bug was found in the netfilter nft_inner module's error path where local_bh_enable() is called before local_unlock_nested_bh(), potentially causing incorrect lock state and synchronization issues.

In the Linux kernel's ksmbd (SMB3) subsystem, two related vulnerabilities were found: reuse of the fp->node list head causing list corruption and a reference count race leading to use-after-free (UAF) during durable handle cleanup by ksmbd_durable_scavenger().

In the Linux kernel, a missing lock around the tc_count increment in smb2_find_smb_sess_tcon_unlocked() was found. This issue arose after a refactoring of CIFS code that changed locking from cifs_tcp_ses_lock to tc_lock but did not cover this specific location.

A vulnerability was found in the Linux kernel's IOAM implementation for IPv6. The ipv6_hop_ioam() function fails to refresh the hdr pointer after a potential data buffer reallocation by skb_ensure_writable(), leading to a Use-After-Free condition.

In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.

In the Linux kernel, a use-after-free vulnerability was found in the mlx5e driver in the mlx5e_tx_reporter_timeout_recover function. The issue occurs when the function accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its SQs). The fix replaces three sq->netdev references with priv->netdev, which is safe because priv outlives channel teardown.

In the Linux kernel's ixgbevf driver, a use-after-free vulnerability was found in ixgbevf_clean_rx_irq(). During VEPA multicast source pruning, after freeing the skb buffer, the pointer is not nullified, leading to a dereference of freed memory in the next loop iteration.

In the Linux kernel's KVM for ARM64, a vulnerability was found in the emulated ITS (Interrupt Translation Service) controller. The function restoring Device Table Entries (DTE) did not validate the number of EventID bits, allowing restoration of an out-of-range value larger than supported by the virtual ITS.

In the Linux kernel, the RDMA/siw (Soft-iWARP) driver lacks validation of the MPA header length in received FPDU frames. A malicious remote peer can send a frame with an mpa_len smaller than the required DDP/RDMAP header, causing a signed integer underflow and leading to a use-after-free memory read.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the Linux kernel's batman-adv implementation. During local TT-based TVLV generation, the VLAN count is checked first, then a buffer is allocated. Despite holding a lock, the number of TT entries per VLAN can increase between check and allocation, causing a buffer overflow.