Vulnerabilities

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument filter_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> eventpoll: fix ep_remove struct eventpoll / struct file UAF<br /> <br /> ep_remove() (via ep_remove_file()) cleared file-&gt;f_ep under<br /> file-&gt;f_lock but then kept using @file inside the critical section<br /> (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).<br /> A concurrent __fput() taking the eventpoll_release() fastpath in<br /> that window observed the transient NULL, skipped<br /> eventpoll_release_file() and ran to f_op-&gt;release / file_free().<br /> <br /> For the epoll-watches-epoll case, f_op-&gt;release is<br /> ep_eventpoll_release() -&gt; ep_clear_and_put() -&gt; ep_free(), which<br /> kfree()s the watched struct eventpoll. Its embedded -&gt;refs<br /> hlist_head is exactly where epi-&gt;fllink.pprev points, so the<br /> subsequent hlist_del_rcu()&amp;#39;s "*pprev = next" scribbles into freed<br /> kmalloc-192 memory.<br /> <br /> In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot<br /> backing @file could be recycled by alloc_empty_file() --<br /> reinitializing f_lock and f_ep -- while ep_remove() is still<br /> nominally inside that lock. The upshot is an attacker-controllable<br /> kmem_cache_free() against the wrong slab cache.<br /> <br /> Pin @file via epi_fget() at the top of ep_remove() and gate the<br /> critical section on the pin succeeding. With the pin held @file<br /> cannot reach refcount zero, which holds __fput() off and<br /> transitively keeps the watched struct eventpoll alive across the<br /> hlist_del_rcu() and the f_lock use, closing both UAFs.<br /> <br /> If the pin fails @file has already reached refcount zero and its<br /> __fput() is in flight. Because we bailed before clearing f_ep,<br /> that path takes the eventpoll_release() slow path into<br /> eventpoll_release_file() and blocks on ep-&gt;mtx until the waiter<br /> side&amp;#39;s ep_clear_and_put() drops it. The bailed epi&amp;#39;s share of<br /> ep-&gt;refcount stays intact, so the trailing ep_refcount_dec_and_test()<br /> in ep_clear_and_put() cannot free the eventpoll out from under<br /> eventpoll_release_file(); the orphaned epi is then cleaned up<br /> there.<br /> <br /> A successful pin also proves we are not racing<br /> eventpoll_release_file() on this epi, so drop the now-redundant<br /> re-check of epi-&gt;dying under f_lock. The cheap lockless<br /> READ_ONCE(epi-&gt;dying) fast-path bailout stays.

A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is best practice to apply a patch to resolve this issue.

A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c of the component ue-authentications Endpoint. Performing a manipulation results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is the recommended action to fix this issue.

A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function handle_scp_info in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. To fix this issue, it is recommended to deploy a patch.

A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available and might be used. It is advisable to implement a patch to correct this issue.

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the &amp;#39;swlatlng&amp;#39; and &amp;#39;nelatlng&amp;#39; parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER[&amp;#39;QUERY_STRING&amp;#39;] via parse_str() (bypassing WordPress&amp;#39;s wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on &amp;#39;,&amp;#39; via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without is_numeric() validation, (float) casting, esc_sql(), or $wpdb-&gt;prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the site to host the Posts Locator search-results shortcode (`[gmw form="results" form_id=N]`) on a public page and to have at least one published post with an associated gmw_location row.

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unreact_to_event()). The endpoints register get_items_permissions_check() as their permission_callback, which only verifies the requester is logged in and does not enforce the per-logger capability checks normally applied by Log_Query. As a result, a Subscriber-level user can POST to /wp-json/simple-history/v1/events//react with the _fields=context query parameter and read the full context of any Simple History event — including SimpleUserLogger entries that record the full password-reset email body (reset URL with the reset key) for any user. The attacker triggers a password reset for an administrator via the lost-password form, brute-forces recent event IDs through the reaction endpoint to read the resulting user_requested_password_reset_link event, extracts the reset key from context.message, and completes the password reset to take over the administrator account. Exploitation requires an administrator to have first enabled the experimental features option (simple_history_experimental_features_enabled), which is not the default.

A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been made public and could be used. A patch should be applied to remediate this issue.

A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. This impacts an unknown function of the component Login Page. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. Affected is an unknown function of the component Dashboard Page. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.