CVE Vulnerability Catalog

In the Linux kernel, do_close_on_exec() is called while holding exec_update_lock, which can block waiting for a filesystem reply. This can lead to deadlock if a FUSE filesystem tries to inspect the calling process, or block codepaths using exec_update_lock. The fix moves do_close_on_exec() before taking exec_update_lock, but after copying the FD table if necessary.

In the Linux kernel s390/crypto module (aes_s390), return codes from skcipher_walk_virt() are not properly checked before entering processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, leading to incorrect behavior or access to uninitialized memory. The fix adds proper return code checking.

In the Linux kernel scsi: qla2xxx driver, __qla2x00_alloc_iocbs() zeroes the QLAFX00 request ring slot with a plain memset(), even though it is ioremapped device I/O memory, not DMA-coherent RAM. On architectures like ARM64, memset() may emit invalid instructions (e.g., DC ZVA) on Device memory, causing a synchronous external abort. The fix uses memset_io() for QLAFX00.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper. Attackers can use percent-encoded directory traversal sequences to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

SQL Injection (CWE-89) exists in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce. An unauthenticated remote attacker can read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

The JetEngine plugin by Crocoblock up to version 3.8.16 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp). Attackers can leak heap memory by crafting a malicious archive where the superblock's no_ids field is set so that the final metadata block's expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Command Injection vulnerability due to improper neutralization of special elements used in a command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.

Radar before version 1.12.2 contains a missing authorization vulnerability in the /api/local-terminal WebSocket endpoint that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's privileges, even when the --disable-local-terminal flag is set.

An OS Command Injection vulnerability (improper neutralization of special elements used in an OS command) exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The vulnerability allows injection and execution of arbitrary operating system commands.

A missing authentication for critical function vulnerability exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The lack of authentication enables OS command injection.

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

A deserialization of untrusted data vulnerability exists in the itthinx Affiliates plugin, allowing object injection. This can lead to unauthorized actions.

The JetProductTables plugin by Crocoblock up to version 1.2.4 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.