Vulnerabilities

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: dev: can_restart: fix use after free bug<br /> <br /> After calling netif_rx_ni(skb), dereferencing skb is unsafe.<br /> Especially, the can_frame cf which aliases skb memory is accessed<br /> after the netif_rx_ni() in:<br /> stats-&gt;rx_bytes += cf-&gt;len;<br /> <br /> Reordering the lines solves the issue.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: vxcan: vxcan_xmit: fix use after free bug<br /> <br /> After calling netif_rx_ni(skb), dereferencing skb is unsafe.<br /> Especially, the canfd_frame cfd which aliases skb memory is accessed<br /> after the netif_rx_ni().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: peak_usb: fix use after free bugs<br /> <br /> After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.<br /> Especially, the can_frame cf which aliases skb memory is accessed<br /> after the peak_usb_netif_rx_ni().<br /> <br /> Reordering the lines solves the issue.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path<br /> <br /> In es58x_rx_err_msg(), if can-&gt;do_set_mode() fails, the function<br /> directly returns without calling netif_rx(skb). This means that the<br /> skb previously allocated by alloc_can_err_skb() is not freed. In other<br /> terms, this is a memory leak.<br /> <br /> This patch simply removes the return statement in the error branch and<br /> let the function continue.<br /> <br /> Issue was found with GCC -fanalyzer, please follow the link below for<br /> details.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context<br /> <br /> If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but<br /> not always, the case), the &amp;#39;WARN_ON(in_irq)&amp;#39; in<br /> net/core/skbuff.c#skb_release_head_state() might be triggered, under network<br /> congestion circumstances, together with the potential risk of a NULL pointer<br /> dereference.<br /> <br /> The root cause of this issue is the call to kfree_skb() instead of<br /> dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().<br /> <br /> This patch prevents the skb to be freed within the call to netif_rx() by<br /> incrementing its reference count with skb_get(). The skb is finally freed by<br /> one of the in-irq-context safe functions: dev_consume_skb_any() or<br /> dev_kfree_skb_any(). The "any" version is used because some drivers might call<br /> can_get_echo_skb() in a normal context.<br /> <br /> The reason for this issue to occur is that initially, in the core network<br /> stack, loopback skb were not supposed to be received in hardware IRQ context.<br /> The CAN stack is an exeption.<br /> <br /> This bug was previously reported back in 2017 in [1] but the proposed patch<br /> never got accepted.<br /> <br /> While [1] directly modifies net/core/dev.c, we try to propose here a<br /> smoother modification local to CAN network stack (the assumption<br /> behind is that only CAN devices are affected by this issue).<br /> <br /> [1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com

FOXCMS

Litepubl CMS

A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access.

IBM i 7.6 <br /> <br /> contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command.  A malicious actor can use the command to elevate privileges to gain root access to the host operating system.

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.