CVE Vulnerability Catalog

W urządzeniach Tuoshi/Dionlink LT15D 4G Wi-Fi oraz LT21B odkryto podatność na wstrzykiwanie poleceń. Atakujący zdalny, nieautoryzowany użytkownik z dostępem do sieci może wykorzystać tę lukę, aby wykonać dowolne polecenia systemowe z uprawnieniami roota.

Podatność CVE-2024-13148 dotyczy niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach SQL w platformie logowania B2B Yukseloglu, co umożliwia atak typu SQL Injection. Problem ten dotyczy wersji platformy przed 16.01.2025.

W wersji 2.15.5 oprogramowania Ciges od ATISoluciones odkryto podatność na wstrzykiwanie SQL. Umożliwia ona atakującemu pobieranie, tworzenie, aktualizowanie oraz usuwanie danych w bazie danych za pomocą parametru $idServicio w punkcie końcowym /modules/ajaxBloqueaCita.php.

In the Linux kernel NFSD subsystem, a use-after-free vulnerability occurs when fetching acl_default fails. Both acl_access and acl_default are released, but acl_access retains a pointer to the freed posix_acl, triggering a kernel warning and panic.

In the Linux kernel's ksmbd module, an integer overflow vulnerability was found on 32-bit systems. Addition operations in ipc_msg_alloc() can overflow, leading to potential memory corruption.

In the Linux kernel, the PCI dwc ep driver has a vulnerability due to lack of protection against changing BAR size/flags in pci_epc_set_bar(). This allows setting a new BAR size that is smaller than the size determined by the host, potentially allowing reads past the new BAR size.

In the Linux kernel's MPTCP implementation, a vulnerability was found due to improper management of suboption status. Zeroing the bitmask before parsing is insufficient to ensure state consistency, leading to uninitialized bitfields and a KMSAN bug.

Urządzenia TP-Link TL-WR845N z oprogramowaniem układowym TL-WR845N(UN)_V4_200909 i TL-WR845N(UN)_V4_190219 zawierają twardo zakodowane hasło dla konta root, które można uzyskać poprzez analizę pobranego oprogramowania lub atak brute force przy fizycznym dostępie do routera. Problem został rozwiązany w wersjach oprogramowania 250401 lub nowszych.

An arbitrary file upload vulnerability was found in FoxCMS v1.2.5 within the LocalTemplate.php component. Attackers can upload a crafted ZIP file, leading to arbitrary code execution on the server.

FoxCMS version 1.2.5 was found to contain a remote code execution (RCE) vulnerability in the index() method at \controller\Sitemap.php. An attacker can exploit this flaw to execute arbitrary code on the server.

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability in the component \c\PluginsController.php. This allows attackers to perform intranet scanning via a crafted request.

An arbitrary file upload vulnerability in Jizhicms v2.5.4 component TemplateController.php allows attackers to execute arbitrary code by uploading a crafted ZIP file.

An arbitrary file upload vulnerability was found in Emlog Pro version 2.5.3 within the admin\plugin.php component. It allows an attacker to execute arbitrary code by uploading a crafted ZIP file.

In the Linux kernel, a vulnerability in the netfilter conntrack module has been fixed, where after insertion of a conntrack entry, a clash can occur, leading to freeing skb->_nfct and setting it to an already-confirmed entry. This was not found before because the conntrack entry and extension space were freed after an RCU grace period, and the race requires events enabled to trigger.

In the Linux kernel, the NFSv4 subsystem has a bug causing free of an uninitialized nfs4_label during referral lookup. The fix sends the already-allocated fattr along with nfs4_fs_locations and drops the memcpy of fattr, fixing a crash during 'ls' operations.

In the Linux kernel, a vulnerability in the DLM module causes an invalid memory read during file unlock (plock) operations. The bug occurs when a 'plock_op' structure is cast to 'plock_xop' and fields not present in the original structure are accessed, leading to a slab-out-of-bounds read. The fix moves the 'callback' field to 'struct plock_op' to indicate when such casting is allowed.

In the Linux kernel, in the nfsd_file_put() function in NFSD, a potential use-after-free was fixed. Since nfsd_file_put_noref() can free @nf, it should not be dereferenced after return.

In the Linux kernel, in the svc_rdma_build_writes() function in SUNRPC, an overflow issue with RDMA segments was fixed by preventing walking off the end of the segment array.

In the Linux kernel, in the nfssvc_decode_writeargs() function in NFSD, an underflow issue with 'args->len' was fixed by changing the type to unsigned.

In the Linux kernel, in the hisilicon/sec crypto driver, a bug with the aead software fallback was fixed. Misuse of the subreq pointer caused occasional OS panics when setting the 64K page.