Vulnerabilities

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP&amp;#39;s ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. <br /> <br /> The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme&amp;#39;s statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions to create or modify such objects, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim&amp;#39;s browser, executing in the context of the MISP application origin. This could allow session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim. <br /> <br /> The vulnerability requires the attacker to have low-level authenticated access to create or rename an object whose name is rendered in the legend, and the victim to view the Overmind event or server preview page. No special browser conditions or race conditions are required.

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i3c: master: Do not treat master device as a duplicate target<br /> <br /> i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C<br /> device with the same PID as the reference device. The search can match<br /> master-&gt;this, causing the controller itself to be returned as a<br /> duplicate.<br /> <br /> Since the controller is not a target device, it cannot be a duplicate of<br /> one. Exclude master-&gt;this from matching so that the function only<br /> returns real duplicate target devices.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i3c: master: Fix use-after-free of master-&gt;this<br /> <br /> sysfs attribute callbacks for the master controller device dereference<br /> master-&gt;this. However, master-&gt;this is freed in<br /> i3c_master_detach_free_devs() before the master device itself is<br /> released.<br /> <br /> As a result, sysfs accesses can dereference a freed master-&gt;this<br /> pointer, leading to a use-after-free.<br /> <br /> Keep master-&gt;this alive until i3c_masterdev_release(), which is called<br /> after the master device and its sysfs state are being torn down. Do not<br /> free master-&gt;this as part of the normal device detach path.<br /> <br /> On the error path in i3c_master_set_info(), reset master-&gt;this and<br /> bus.cur_master to NULL before freeing the allocated device.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: dat: atomically update mac addresses<br /> <br /> When a MAC address is updated in batadv_dat_entry_add(), it is done using a<br /> simple copy function. A parallel reader might only see parts of this<br /> update. In worst case, the reader is transporting the half updated MAC<br /> address over the network or is creating an ARP response using it -<br /> poisoning the ARP cache.<br /> <br /> atomic64_t can be used to store the 48 bit of a mac address. A reader will<br /> then either see the old mac address or the new one - never a mixture of<br /> both.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvdimm: virtio_pmem: refcount requests for token lifetime<br /> <br /> KASAN reports slab-use-after-free in __wake_up_common():<br /> BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160<br /> Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0<br /> <br /> CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted<br /> 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux<br /> 1.17.0-2-2 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x6d/0xb0<br /> print_report+0x170/0x4e2<br /> ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> ? __virt_addr_valid+0x1dc/0x380<br /> kasan_report+0xbc/0xf0<br /> ? __wake_up_common+0x114/0x160<br /> ? __wake_up_common+0x114/0x160<br /> __wake_up_common+0x114/0x160<br /> ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> __wake_up+0x36/0x60<br /> virtio_pmem_host_ack+0x11d/0x3b0<br /> ? sched_balance_domains+0x29f/0xb00<br /> ? __pfx_virtio_pmem_host_ack+0x10/0x10<br /> ? _raw_spin_lock_irqsave+0x98/0x100<br /> ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> vring_interrupt+0x1c9/0x5e0<br /> ? __pfx_vp_interrupt+0x10/0x10<br /> vp_vring_interrupt+0x87/0x100<br /> ? __pfx_vp_interrupt+0x10/0x10<br /> __handle_irq_event_percpu+0x17f/0x550<br /> ? __pfx__raw_spin_lock+0x10/0x10<br /> handle_irq_event+0xab/0x1c0<br /> handle_fasteoi_irq+0x276/0xae0<br /> __common_interrupt+0x65/0x130<br /> common_interrupt+0x78/0xa0<br /> <br /> <br /> virtio_pmem_host_ack() wakes a request that has already been freed by the<br /> submitter.<br /> <br /> This happens when the request token is still reachable via the virtqueue,<br /> but virtio_pmem_flush() returns and frees it.<br /> <br /> Fix the token lifetime by refcounting struct virtio_pmem_request.<br /> virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an<br /> extra reference once the request is queued. The completion path drops the<br /> virtqueue reference, and the submitter drops its reference before<br /> returning.

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.