CVE Vulnerability Catalog

In the Linux kernel, a use-after-free vulnerability was found in the exfat filesystem's exfat_find_dir_entry() function. A buffer_head is released before reading data from it in the TYPE_EXTEND branch, potentially leading to access of freed memory.

A use-after-free vulnerability was found in the Linux kernel's pnfs_update_layout() function in the pNFS implementation. The issue occurs when the NFS_LAYOUT_RETURN branch calls pnfs_put_layout_hdr(lo) before the tracepoint trace_pnfs_update_layout(), which still references the freed 'lo' structure.

In the Linux kernel's 9p filesystem, a vulnerability was found in p9_client_walk() due to improper reference counting. When a non-cloning walk fails, the error path incorrectly drops a reference to oldfid, potentially causing a use-after-free or refcount underflow.

In the Linux kernel's NFSD subsystem, a use-after-free vulnerability exists in layout stateid allocation. When nfsd4_layout_setlease() fails, the stateid is freed without removing it from the IDR registry, leaving a dangling pointer. Subsequent IDR walkers (states_show, client teardown) may dereference freed memory.

A vulnerability was found in the Linux kernel's NFSD server in the SECINFO_NO_NAME decode function. Improper initialization of the sin_exp structure before decoding may lead to using stale data from previous operations, causing an incorrect exp_put() call on an uninitialized pointer.

In the Linux kernel, the 8250_dw driver has a vulnerability where if clk_notifier_register() fails, the 8250 port remains registered while driver data is freed, leading to a use-after-free hazard on subsequent port access before rebind.

A vulnerability in @fastify/http-proxy up to version 11.5.0 causes the request prefix not to be rewritten when the prefix segment is URL-encoded. Fastify URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request encoding one or more characters of the configured prefix matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged, allowing an attacker to reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.

Authorization bypass in Avo framework (Ruby on Rails) allowing low-privileged users to attach related records directly, leading to privilege escalation and cross-tenant data exposure. Fixed in versions 3.32.1 and 4.0.0.beta.51.

The ps_facetedsearch module for PrestaShop from version 3.0.0 to 4.0.4 (before 4.0.4) contains a deserialization vulnerability. The module rebuilds selected search filters from the request URL, and the value of a slider filter (price or weight) is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw unserialize(). An unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when deserialized, a gadget chain writes an arbitrary PHP file inside the module's directory, which is then used as a webshell to run commands on the server.

SQL injection vulnerability in the order() method of CrudOption.java in cool-admin-java 8.0.0.

CodeIgniter before version 4.7.3 contains a vulnerability in the ext_in validation rule, which checks the extension based on the detected MIME type rather than the actual file extension. A file named shell.php with GIF content can pass validation, potentially leading to arbitrary code execution.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.

IBM Langflow OSS 1.0.0 through 1.10.0 contains a path traversal vulnerability in the APIRequest component, where filenames from Content-Disposition headers are not sanitized. An attacker can write arbitrary files to locations accessible by the Langflow process.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).

Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects without validation, integrity verification, or authentication.

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component.