SonicWALL Network Security Manager (NSM) authorization issue vulnerability

SonicWALL Network Security Manager NSM versions 4.3.1 and earlier have an authorization issue vulnerability. This vulnerability stems from improper access control in the export settings. It may allow remote, authenticated attackers to obtain sensitive information, potentially gain administrator...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.190 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Certified attackers with subscription-level or higher permissions can inject any web script into pages through the...

OpenAEV Platform: OpenAEV Authorization Issues Vulnerability

The OpenAEV Platform versions prior to 2.260622.0 have an authorization issue vulnerability. This vulnerability stems from the /api/player/ lessons endpoint, which can be called without authentication, and the userId parameter provided by the client is not verified. This allows unauthorized...

WordPress Tutor LMS Cross-site Scripting Vulnerability

WordPress Tutor LMS versions 4.1.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'tab' parameter. Additionally, when the nav-items array of the target course page is empty, the inarray validation can be...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – Calendar Booking Plugin for Appointments and Events. Versions 5.7.3 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of ownership checks on the bookingid and cartid parameters. Unauthorized attackers can enumerate booking or cart identifiers...

Mogh.tech Komodo configuration error vulnerability

Mogh.tech Komodo 2.3.3 and earlier versions have a configuration error vulnerability. This vulnerability stems from an authentication bypass in the Periphery agent. Due to empty corepublickeys and passkeys lists by default, unauthenticated attackers can act as trusted Core connections and send...

Yiyi Wang Markdown Preview: Enhanced input validation bug

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contains a vulnerability in input validation. This vulnerability stems from the crossnote.updateMarkdown command accepting arbitrary URIs and content controlled by attackers. Additionally, it does not verify whether the target is indee...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

WordPress Post Export Import with Media: Deserialization Injection Vulnerability

WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...

Yiyi Wang Crossnote Code Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.29 have a code injection vulnerability. This vulnerability stems from the use of vm.runInNewContext in the .crossnote/config.js and .crossnote/parser.js files, which lack a secure boundary with the Node.js host domain. Opening Markdown files from...

WordPress Directorist Cross-Site Script Vulnerability

WordPress Directorist versions 8.10.2.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'phone' list field, resulting in a stored-cross-site scripting attack. Additionally, the plugin grants the...

Hippoo Mobile App for WooCommerce: Cross-site Scripting Vulnerability

The Hippoo Mobile App for WooCommerce version 1.12.0 and earlier has a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, making it susceptible to reflection-based cross-site scripting attacks...

Jordan Harband: Improper exception handling leads to vulnerabilities

Jordan Harband versions from 6.7.0 to 6.16.1 have security vulnerabilities. This vulnerability arises from improper string coercion of array elements when using arrayFormat with a comma. When elements cannot be converted to strings, a type error will occur, potentially allowing unverified attacke...

SonicWALL Network Security Manager (NSM) command injection vulnerability

SonicWALL Network Security Manager NSM versions 4.3.1 and earlier have a command injection vulnerability. This vulnerability stems from OS command injections, which may allow remote authentication attackers to execute arbitrary OS commands, resulting in remote code execution...

Hitachi Vantara Remote Operations Agent Authorization Issue Vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability stems from the API output containing a password reset code, which could allow attackers with administrator privileges to retrieve the password reset code of any user and take...

curl resource management error vulnerability

There is a vulnerability in curl’s resource management. This vulnerability arises from incorrect handling of HTTP/2 RSTSTREAM responses by curl during the upload process. The reason for this is that HTTP11REQUIRED or REFUSEDSTREAM conditions were encountered, leading to the reutilization of the...

Yiyi Wang Markdown Preview Enhanced Permission Licensing and Access Control Vulnerabilities

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contained vulnerabilities related to permission management and access control. These vulnerabilities stemmed from the webview message handler in src/preview-provider.ts, which failed to validate command values and parameters against a...

Kedacore KEDA: Permissions management and access control vulnerabilities

KEDACORE KEDA 2.20.2 and earlier versions have security vulnerabilities. This vulnerability arises from the ability of the namespace administrator to create TriggerAuthentication and ScaledObject resources, thereby setting hashiCorpVault.address as a tenant-controlled endpoint. By selecting...

WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability

WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...

M A Vinoth Kumar Frontend Dashboard: Permissions, Licenses, and Access Control Vulnerabilities

The M A Vinoth Kumar Frontend Dashboard 3.0.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.97, as well as versions from 9.0.0 to 9.10.2-alpha.6, have a vulnerability related to improper exception handling. This vulnerability arises from errors that occur when sending verification emails or password reset emails. Attackers only...

OpenSIPS buffer error vulnerability

OpenSIPS versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 4.0.0, and 4.0.1 have a buffer error vulnerability. This vulnerability stems from the operation of the rtpproxyoffer/rtpproxyanswer functions in the rtpproxy component, which leads to out-of-bounds read access. This...

Hyyan WooCommerce Polylang Integration SQL Injection Vulnerability

Hyyan WooCommerce Polylang Integration 1.5.0 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the variationid parameter in the woocommerceremovevariations AJAX operation, as well as inadequate preparation of existing SQL queries. This...

Yiyi Wang Crossnote Command Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.28 contain a command injection vulnerability. This vulnerability stems from the handling of preview links, which pass the decoded link target to the Windows file open helper program. This program uses the start command to call childprocess.exec. When...

GStreamer buffer error vulnerability

GStreamer has a buffer error vulnerability. This vulnerability stems from the DCI parsing function in GStreamer’s H.266 codec parsing library, which incorrectly accepts reserved field values, leading to out-of-bounds writes and potentially causing crashes or memory corruption...

Red Hat Enterprise Linux Log Information Leakage Vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a vulnerability related to log information leakage. This vulnerability stems from the clevis-PKCS11 pin’s clevis-pkcs11-afunix-socket-unlock daemon, which records LUKS disk encryption passwords in plain text into log files. Additionally, when...

Khronos Group NNEF-Tools path traversal vulnerability

The Khronos Group NNEF-Tools has a path traversal vulnerability. This vulnerability arises from path traversal through specially crafted variable tags. Attackers can create or overwrite the “.dat” file by providing a graph.nnef file with a “../” sequence or an absolute path tag during user...

Portkey Gateway server request forgery vulnerability

Portkey Gateway version 1.14.0 to 1.15.2 has a server-side request forgeing vulnerability. This vulnerability arises from the isValidCustomHost function, which trusts the localhost-style host when TRUSTEDCUSTOMHOSTS is not set. Additionally, the x-portkey-custom-host header is not validated. As a...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – a calendar booking plugin for appointments and events. Versions 5.7.2 and earlier have an authorization issue vulnerability. This vulnerability arises from calling the OsCustomerHelper::createwpuserforcustomer helper function from the publicly exposed processstepcustomer step. When th...

Ravi Teja Online-Examination-System Information Leak Vulnerability

Ravi Teja Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 and previous versions have a security vulnerability. This vulnerability stems from operations on an unknown function in the dbtables.sql file, which can be exploited remotely, leading to information leakage...

Hitachi Vantara Remote Operations Agent encryption vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.60 to 2.0 have encryption-related vulnerabilities. These vulnerabilities stem from the use of the default self-signed SSL certificate for signing JWT access tokens for the web interface. Attackers can exploit this default certificate to issue JWT...

WordPress Jeg Kit for Elementor Authorization Issue Vulnerability

The WordPress JEG Kit for Elementor 3.2.19 and earlier versions has an authorization issue vulnerability. This vulnerability stems from the lack of permission checks for the two AJAX operations called ‘jkitpostblock’ and ‘jegfindauthor’. This could allow authenticated attackers with...

WordPress Calendar SQL Injection Vulnerability

Versions of WordPress Calendar prior to 7.37.0 have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

Hyland Desktop Host Permission Licensing and Access Control Vulnerabilities

Hyland Desktop Host for Windows versions prior to 25.1.1 have a vulnerability related to permission permissions and access control. This vulnerability arises from privileged services running with low privileges from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder, which may allow local users to...

WordPress WP OAuth Server Authorization Issue Vulnerability

WordPress WP OAuth Server versions 6.4.0 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization, which may allow attackers to exploit incorrectly configured access control levels...

Kristofer Berggren Rapidcsv numerical error vulnerability

The Kristofer Berggren Rapidcsv versions before 8.99 have a security vulnerability. This vulnerability stems from the RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames functions, which add iterators to std::vector after converting sizet indices to int. On 64-bit systems, when...

Rakuten Mobile Rakuten Mini Trust Management Vulnerability

Rakuten Mobile and Rakuten Mini have vulnerabilities related to trust management. These vulnerabilities stem from the use of the Android Verified Boot AVB feature with AOSP test keys. Attackers could potentially install modified system images by physically accessing affected devices...

WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities

WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...

Hitachi Vantara Remote Ops Agent Authorization Vulnerability

The Hitachi Vantara Remote Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability arises from the lack of rate limiting on attempts to input the reset code after the password reset function is enabled and the email configuration is set. This could allow...

Yiyi Wang Crossnote Cross-site Scripting Vulnerability

Yiyi Wang’s Crossnote version prior to 0.8.30 has a cross-site scripting vulnerability. This vulnerability stems from reading the content of crossnote/head.html and inserting a preview webview document during processing of resolvePathsInHeader. The executable content is not removed after...

OpenClaw ClawScan processing logic error vulnerability

OpenClaw ClawScan versions 0.1.6 and earlier have a processing logic vulnerability. This vulnerability stems from improper operation of the shouldSkipTargetPath function in the internal/runner/runner.go file of the Static Scanner component, which may lead to the failure of the protection mechanis...

David Eriksson Unshield buffer error vulnerability

David Eriksson’s Unshield versions 1.6.2 and earlier contain a buffer error vulnerability. This vulnerability stems from the Unshieldgetfiletable function, which allows for heap out-of-bounds reads without checking the offset of the cabinet header. An attacker could provide a specially crafted...

OpenCATS arbitrary file upload vulnerability

Versions of OpenCATS prior to 0.10.0 have a vulnerability related to arbitrary file uploads. This vulnerability stems from the Import module, specifically modules/import/ImportUI.php. This file retains the original name of the uploaded file and places it in a temporary directory accessible to the...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

Siemens RUGGEDCOM CROSSBOW information leakage vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a vulnerability related to information leakage. This vulnerability stems from insufficient restrictions on access to various database queries. It may allow authenticated attackers to retrieve system-wide information beyond their authorized...

Podman-container-tools: Podman processing logic error vulnerability

The podman-container-tools project has a processing logic error vulnerability in versions of Podman from 4.4.0 to 5.8.8, and from 6.0.0 to 6.1.3. This vulnerability arises because the podman run command treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints...

Kerwin FastBee authorization issue vulnerability

Kerwin FastBee versions 2.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DeviceController. Certified low-privilege users can read and modify devices of other tenants by providing the sequential device ID...

Swann Communications SWIFI-SE2KIC Authorization Issue Vulnerability

Swann Communications SWIFI-SE2KIC 2.0.22 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authentication for key functions, allowing attackers on the local network to view real-time videos without being authenticated...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...