CVE Vulnerability Catalog

In the Linux kernel, the rt6_route_rcv() function has an incorrect validation of the Route Information option length (RFC 4191). Due to an off-by-one error, the kernel can read up to 8 bytes past the end of the option, potentially leaking data from adjacent memory into routes visible to userspace.

In the Linux kernel, the fscrypt_ioctl_set_policy() function uses nop_mnt_idmap instead of the mount's idmap when checking file ownership. On filesystems supporting idmapped mounts (e.g., ext4, f2fs), this can lead to incorrect denial of access to the actual owner or granting access to an unrelated caller.

A vulnerability in the Linux kernel's PSI (Pressure Stall Information) mechanism for cgroups was found. A race between psi_schedule_rtpoll_work() and psi_trigger_destroy() can lead to re-arming a timer after its deletion, resulting in a use-after-free when the timer fires on a freed group structure.

In the Linux kernel, the IMA mechanism lacks immediate reset of action cache flags (IMA_DONE_MASK) during truncate operations. The fix instantiates file_truncate and path_truncate hooks to force re-collection, re-measurement, re-audit, and re-appraisal on next access.

In the Linux kernel, the bpf_get_fsverity_digest() function has an issue with dynptr assumptions. Although the BPF verifier and dynptr abstraction ensure memory validity, they do not guarantee stability of contents. The function could crash if arg->digest_size was concurrently modified. The fix uses the known-good value hash_alg->digest_size and widens types to u64.

A use-after-free vulnerability has been found in the Linux kernel's BPF sockmap mechanism during send verdict processing. The issue occurs because tcp_bpf_send_verdict() copies a pointer to the destination socket without taking a reference, which can lead to use of freed memory under concurrent access. An attacker could exploit this flaw to escalate privileges or cause a system crash.

The Joomla extension Fabrik before version 4.7.2 contains an unauthenticated stored XSS vulnerability. The handling of user-supplied input in the jsactions feature leads to a stored XSS vector.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to disclose the list of database tables and the table prefix. The ajax_tables method of the elements model permits listing arbitrary database tables including their columns.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to list arbitrary directories on the server. The onAjax_getFolders method of the elements model permits arbitrary directory listings.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to upload arbitrary non-executable files to the web root. The vulnerability is in the list email plugin controller.

The Joomla extension Fabrik before version 4.7.2 allows an unauthenticated attacker to truncate the target list's table. The list.doempty endpoint lacks ACL gates, and a plain GET empties the table.

In the Linux kernel, the RDMA bnxt_re driver has a kernel memory leak to userspace. The shared page (shpg) is not zeroed before being exposed to userspace, causing unsanitized kernel data to be revealed. The fix uses get_zeroed_page() instead of __get_free_page().

Hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.