Mogh.tech Komodo configuration error vulnerability

Mogh.tech Komodo 2.3.3 and earlier versions have a configuration error vulnerability. This vulnerability stems from an authentication bypass in the Periphery agent. Due to empty corepublickeys and passkeys lists by default, unauthenticated attackers can act as trusted Core connections and send...

Yiyi Wang Markdown Preview: Enhanced input validation bug

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contains a vulnerability in input validation. This vulnerability stems from the crossnote.updateMarkdown command accepting arbitrary URIs and content controlled by attackers. Additionally, it does not verify whether the target is indee...

OpenSIPS buffer error vulnerability

OpenSIPS versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 4.0.0, and 4.0.1 have a buffer error vulnerability. This vulnerability stems from the operation of the rtpproxyoffer/rtpproxyanswer functions in the rtpproxy component, which leads to out-of-bounds read access. This...

Yiyi Wang Markdown Preview Enhanced Permission Licensing and Access Control Vulnerabilities

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contained vulnerabilities related to permission management and access control. These vulnerabilities stemmed from the webview message handler in src/preview-provider.ts, which failed to validate command values and parameters against a...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

Hippoo Mobile App for WooCommerce: Cross-site Scripting Vulnerability

The Hippoo Mobile App for WooCommerce version 1.12.0 and earlier has a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, making it susceptible to reflection-based cross-site scripting attacks...

Jordan Harband: Improper exception handling leads to vulnerabilities

Jordan Harband versions from 6.7.0 to 6.16.1 have security vulnerabilities. This vulnerability arises from improper string coercion of array elements when using arrayFormat with a comma. When elements cannot be converted to strings, a type error will occur, potentially allowing unverified attacke...

SonicWALL Network Security Manager (NSM) command injection vulnerability

SonicWALL Network Security Manager NSM versions 4.3.1 and earlier have a command injection vulnerability. This vulnerability stems from OS command injections, which may allow remote authentication attackers to execute arbitrary OS commands, resulting in remote code execution...

Hitachi Vantara Remote Operations Agent Authorization Issue Vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability stems from the API output containing a password reset code, which could allow attackers with administrator privileges to retrieve the password reset code of any user and take...

curl resource management error vulnerability

There is a vulnerability in curl’s resource management. This vulnerability arises from incorrect handling of HTTP/2 RSTSTREAM responses by curl during the upload process. The reason for this is that HTTP11REQUIRED or REFUSEDSTREAM conditions were encountered, leading to the reutilization of the...

Kedacore KEDA: Permissions management and access control vulnerabilities

KEDACORE KEDA 2.20.2 and earlier versions have security vulnerabilities. This vulnerability arises from the ability of the namespace administrator to create TriggerAuthentication and ScaledObject resources, thereby setting hashiCorpVault.address as a tenant-controlled endpoint. By selecting...

Portkey Gateway server request forgery vulnerability

Portkey Gateway version 1.14.0 to 1.15.2 has a server-side request forgeing vulnerability. This vulnerability arises from the isValidCustomHost function, which trusts the localhost-style host when TRUSTEDCUSTOMHOSTS is not set. Additionally, the x-portkey-custom-host header is not validated. As a...

Khronos Group NNEF-Tools path traversal vulnerability

The Khronos Group NNEF-Tools has a path traversal vulnerability. This vulnerability arises from path traversal through specially crafted variable tags. Attackers can create or overwrite the “.dat” file by providing a graph.nnef file with a “../” sequence or an absolute path tag during user...

WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability

WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...

M A Vinoth Kumar Frontend Dashboard: Permissions, Licenses, and Access Control Vulnerabilities

The M A Vinoth Kumar Frontend Dashboard 3.0.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.97, as well as versions from 9.0.0 to 9.10.2-alpha.6, have a vulnerability related to improper exception handling. This vulnerability arises from errors that occur when sending verification emails or password reset emails. Attackers only...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – a calendar booking plugin for appointments and events. Versions 5.7.2 and earlier have an authorization issue vulnerability. This vulnerability arises from calling the OsCustomerHelper::createwpuserforcustomer helper function from the publicly exposed processstepcustomer step. When th...

Ravi Teja Online-Examination-System Information Leak Vulnerability

Ravi Teja Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 and previous versions have a security vulnerability. This vulnerability stems from operations on an unknown function in the dbtables.sql file, which can be exploited remotely, leading to information leakage...

Hitachi Vantara Remote Operations Agent encryption vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.60 to 2.0 have encryption-related vulnerabilities. These vulnerabilities stem from the use of the default self-signed SSL certificate for signing JWT access tokens for the web interface. Attackers can exploit this default certificate to issue JWT...

WordPress Jeg Kit for Elementor Authorization Issue Vulnerability

The WordPress JEG Kit for Elementor 3.2.19 and earlier versions has an authorization issue vulnerability. This vulnerability stems from the lack of permission checks for the two AJAX operations called ‘jkitpostblock’ and ‘jegfindauthor’. This could allow authenticated attackers with...

Yiyi Wang Crossnote Cross-site Scripting Vulnerability

Yiyi Wang’s Crossnote version prior to 0.8.30 has a cross-site scripting vulnerability. This vulnerability stems from reading the content of crossnote/head.html and inserting a preview webview document during processing of resolvePathsInHeader. The executable content is not removed after...

WordPress Calendar SQL Injection Vulnerability

Versions of WordPress Calendar prior to 7.37.0 have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

Hitachi Vantara Remote Ops Agent Authorization Vulnerability

The Hitachi Vantara Remote Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability arises from the lack of rate limiting on attempts to input the reset code after the password reset function is enabled and the email configuration is set. This could allow...

Hyyan WooCommerce Polylang Integration SQL Injection Vulnerability

Hyyan WooCommerce Polylang Integration 1.5.0 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the variationid parameter in the woocommerceremovevariations AJAX operation, as well as inadequate preparation of existing SQL queries. This...

Hyland Desktop Host Permission Licensing and Access Control Vulnerabilities

Hyland Desktop Host for Windows versions prior to 25.1.1 have a vulnerability related to permission permissions and access control. This vulnerability arises from privileged services running with low privileges from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder, which may allow local users to...

WordPress Post Export Import with Media: Deserialization Injection Vulnerability

WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...

Yiyi Wang Crossnote Code Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.29 have a code injection vulnerability. This vulnerability stems from the use of vm.runInNewContext in the .crossnote/config.js and .crossnote/parser.js files, which lack a secure boundary with the Node.js host domain. Opening Markdown files from...

David Eriksson Unshield buffer error vulnerability

David Eriksson’s Unshield versions 1.6.2 and earlier contain a buffer error vulnerability. This vulnerability stems from the Unshieldgetfiletable function, which allows for heap out-of-bounds reads without checking the offset of the cabinet header. An attacker could provide a specially crafted...

WordPress Directorist Cross-Site Script Vulnerability

WordPress Directorist versions 8.10.2.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'phone' list field, resulting in a stored-cross-site scripting attack. Additionally, the plugin grants the...

OpenCATS arbitrary file upload vulnerability

Versions of OpenCATS prior to 0.10.0 have a vulnerability related to arbitrary file uploads. This vulnerability stems from the Import module, specifically modules/import/ImportUI.php. This file retains the original name of the uploaded file and places it in a temporary directory accessible to the...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

Siemens RUGGEDCOM CROSSBOW information leakage vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a vulnerability related to information leakage. This vulnerability stems from insufficient restrictions on access to various database queries. It may allow authenticated attackers to retrieve system-wide information beyond their authorized...

Podman-container-tools: Podman processing logic error vulnerability

The podman-container-tools project has a processing logic error vulnerability in versions of Podman from 4.4.0 to 5.8.8, and from 6.0.0 to 6.1.3. This vulnerability arises because the podman run command treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints...

Kerwin FastBee authorization issue vulnerability

Kerwin FastBee versions 2.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DeviceController. Certified low-privilege users can read and modify devices of other tenants by providing the sequential device ID...

Phase Console Authorization Vulnerability

Phase Console versions 2.77.3 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authorization checks, allowing organization members without Secrets reading permissions to access key history through the secretHistory GraphQL query. An attacker who...

Swann Communications SWIFI-SE2KIC Authorization Issue Vulnerability

Swann Communications SWIFI-SE2KIC 2.0.22 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authentication for key functions, which may allow attackers on the local network to access real-time video streams without being authenticated...

Swann Communications SWIFI-SE2KIC Authorization Issue Vulnerability

Swann Communications SWIFI-SE2KIC 2.0.22 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authentication for key functions, allowing attackers on the local network to view real-time videos without being authenticated...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...

Okta RADIUS Agent resource management error vulnerability

The Okta RADIUS Agent versions from 2.17.5 to 2.28.0 have a resource management error vulnerability. This vulnerability arises from the lack of verification of the length of sub-attributes when parsing the Vendor-Specific attribute. Sub-attributes with a length of zero can cause the parser to ent...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...

Joseph Huckaby xyOps Cross-Site Scripting Vulnerability

Joseph Huckaby’s xyOps version 0.9.119 and earlier contain a cross-site scripting vulnerability. This vulnerability arises from the fact that the administrator’s Activity Log includes the item.user.fullname value in the HTML code without proper entity encoding. Additionally, the pixl-server-user...

WordPress Ad Inserter has a vulnerability related to information leakage

WordPress Ad Inserter 2.8.18 and earlier versions have a vulnerability involving information leakage. This vulnerability stems from the aiwpfooterhook, which exposes sensitive information. It is possible for authenticated attackers with privileges at the subscriber level or higher to extract...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of inputs when processing facility names in batch import/export workflows. It may allow authenticated attackers with specific privileges to execute...

Siemens RUGGEDCOM CROSSBOW authorization issue vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have an authorization issue vulnerability. This vulnerability stems from the failure to properly restrict access to sensitive configuration items through specific database queries. As a result, authenticated attackers may obtain administrative...

TechSmith MP4V2 has vulnerabilities related to improper exception handling.

The Techsmith MP4V2 2.0.0 version has a vulnerability in exception handling. This vulnerability stems from a null pointer dereferencing in the src/mp4file.cpp function, MP4File::GenerateTracks. This could allow a remote attacker to cause a denial-of-service attack...

WordPress WP User Manager Authorization Vulnerability

WordPress WP User Manager versions 2.9.23 and earlier have a vulnerability related to authorization. This vulnerability stems from an absence of proper authorization checks, which may lead to exploitation by improperly configured access control levels...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of the input values for the Name and Value fields of custom file tags. This allows attackers with authenticated and administrator privileges to...

Ravi Teja Online-Examination-System Processing Logic Vulnerability

Ravi Teja Online-Examination-System has a processing logic vulnerability. This vulnerability stems from the Session::checkLogin function in the include/session.php file within the Session Handler component. The function manipulates the parameters cookname/cookid, leading to incorrect comparisons...

The-40-Thieves obsidian-tc backend link vulnerability

The The-40-Thieves obsidian-tc versions before 1.3.1 have a security vulnerability. This vulnerability stems from reading the access control list, where the check for lexical paths includes checking resolved paths as well. This allows symbolic links within libraries that are allowed by wildcarded...