CVE-2026-49418

When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, a...

CVE-2026-49418 Use-after-free in device pager page list

When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, a...

CVE-2026-49418

On FreeBSD, calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object leaves invalidated pages in the pager's page list; a subsequent page fault re-inserts them, corrupting the list and causing a double-free on object destruction. An unprivileged local user with memory-mapped I/O ac...

FreeBSD : FreeBSD -- Use-after-free in device pager page list (5a34b147-74e0-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5a34b147-74e0-11f1-958d-bc241121aa0a advisory. When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the...

PT-2026-70013

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description Calling the msyncMS INVALIDATE function on a mapping of an unmanaged device object causes physical pages in the mapping range to be marked invalid while remaining in the pager's page list. A...

FreeBSD-SA-26:37.vm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:37.vm Security Advisory The FreeBSD Project Topic: Use-after-free in device pager page list Category: core Module: vm Announced: 2026-06-30 Credits: slidybat...

RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`

Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of Mmap::uncheckedadviserange, MmapMut::uncheckedadviseranage and MmapMut::flushasyncrange. This can cause undefined behavior due to invalid values being passed to pointer::offset and pointer::add when...

CVE-2023-49166

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

EUVD-2004-0434

Malware in sbrugna...

EUVD-2023-53171

Malicious code in bioql PyPI...

The vulnerabilities in the mm/madvise.c and mm/msync.c components of the Linux kernel allow a hacker to trigger a service failure.

The vulnerability in the mm/madvise.c and mm/msync.c components of the Linux kernel involves the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2023-49166

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

CVE-2023-49166

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

CVE-2023-49166

CVE-2023-49166 affects the WordPress MSync plugin by Magic Logix, versioned as <= 1.0.0. The rooted issue is an SQL Injection caused by improper neutralization of input in SQL commands, enabling a malicious actor with administrator privileges to influence queries. Public sources in the connect...

CVE-2023-49166 WordPress MSync Plugin <= 1.0.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

WordPress Plugin MSync SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress MSync Plugin <= 1.0.0 is vulnerable to SQL Injection

Software MSync Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-49166 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID a473b2f79845 Credits Mika Required privilege Administrator Published 29 November,...

SUSE CVE-2015-7312

Multiple race conditions in the Advanced Union Filesystem aufs aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service use-after-free and BUG or possibly gain privileges via a 1 madvise or 2 msync system call, related to...

Linux kernel competitive conditions vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A competitive condition vulnerability exists in the Advanced Union Filesystem aufs aufs3-mmap.patch and aufs4-mmap.patch patches for Linux kernel versions 3.x and 4.x. The...