LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – Calendar Booking Plugin for Appointments and Events. Versions 5.7.3 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of ownership checks on the bookingid and cartid parameters. Unauthorized attackers can enumerate booking or cart identifiers...

WordPress Calendar SQL Injection Vulnerability

Versions of WordPress Calendar prior to 7.37.0 have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

David Eriksson Unshield buffer error vulnerability

David Eriksson’s Unshield versions 1.6.2 and earlier contain a buffer error vulnerability. This vulnerability stems from the Unshieldgetfiletable function, which allows for heap out-of-bounds reads without checking the offset of the cabinet header. An attacker could provide a specially crafted...

WordPress WP OAuth Server Authorization Issue Vulnerability

WordPress WP OAuth Server versions 6.4.0 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization, which may allow attackers to exploit incorrectly configured access control levels...

Red Hat Enterprise Linux Log Information Leakage Vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a vulnerability related to log information leakage. This vulnerability stems from the clevis-PKCS11 pin’s clevis-pkcs11-afunix-socket-unlock daemon, which records LUKS disk encryption passwords in plain text into log files. Additionally, when...

Kristofer Berggren Rapidcsv numerical error vulnerability

The Kristofer Berggren Rapidcsv versions before 8.99 have a security vulnerability. This vulnerability stems from the RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames functions, which add iterators to std::vector after converting sizet indices to int. On 64-bit systems, when...

Hyland Desktop Host Permission Licensing and Access Control Vulnerabilities

Hyland Desktop Host for Windows versions prior to 25.1.1 have a vulnerability related to permission permissions and access control. This vulnerability arises from privileged services running with low privileges from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder, which may allow local users to...

Khronos Group NNEF-Tools path traversal vulnerability

The Khronos Group NNEF-Tools has a path traversal vulnerability. This vulnerability arises from path traversal through specially crafted variable tags. Attackers can create or overwrite the “.dat” file by providing a graph.nnef file with a “../” sequence or an absolute path tag during user...

Mogh.tech Komodo configuration error vulnerability

Mogh.tech Komodo 2.3.3 and earlier versions have a configuration error vulnerability. This vulnerability stems from an authentication bypass in the Periphery agent. Due to empty corepublickeys and passkeys lists by default, unauthenticated attackers can act as trusted Core connections and send...

Yiyi Wang Markdown Preview: Enhanced input validation bug

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contains a vulnerability in input validation. This vulnerability stems from the crossnote.updateMarkdown command accepting arbitrary URIs and content controlled by attackers. Additionally, it does not verify whether the target is indee...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

WordPress Post Export Import with Media: Deserialization Injection Vulnerability

WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...

Yiyi Wang Crossnote Code Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.29 have a code injection vulnerability. This vulnerability stems from the use of vm.runInNewContext in the .crossnote/config.js and .crossnote/parser.js files, which lack a secure boundary with the Node.js host domain. Opening Markdown files from...

WordPress Directorist Cross-Site Script Vulnerability

WordPress Directorist versions 8.10.2.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'phone' list field, resulting in a stored-cross-site scripting attack. Additionally, the plugin grants the...

Hippoo Mobile App for WooCommerce: Cross-site Scripting Vulnerability

The Hippoo Mobile App for WooCommerce version 1.12.0 and earlier has a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, making it susceptible to reflection-based cross-site scripting attacks...

Jordan Harband: Improper exception handling leads to vulnerabilities

Jordan Harband versions from 6.7.0 to 6.16.1 have security vulnerabilities. This vulnerability arises from improper string coercion of array elements when using arrayFormat with a comma. When elements cannot be converted to strings, a type error will occur, potentially allowing unverified attacke...

SonicWALL Network Security Manager (NSM) command injection vulnerability

SonicWALL Network Security Manager NSM versions 4.3.1 and earlier have a command injection vulnerability. This vulnerability stems from OS command injections, which may allow remote authentication attackers to execute arbitrary OS commands, resulting in remote code execution...

Hitachi Vantara Remote Operations Agent Authorization Issue Vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability stems from the API output containing a password reset code, which could allow attackers with administrator privileges to retrieve the password reset code of any user and take...

curl resource management error vulnerability

There is a vulnerability in curl’s resource management. This vulnerability arises from incorrect handling of HTTP/2 RSTSTREAM responses by curl during the upload process. The reason for this is that HTTP11REQUIRED or REFUSEDSTREAM conditions were encountered, leading to the reutilization of the...

Yiyi Wang Markdown Preview Enhanced Permission Licensing and Access Control Vulnerabilities

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contained vulnerabilities related to permission management and access control. These vulnerabilities stemmed from the webview message handler in src/preview-provider.ts, which failed to validate command values and parameters against a...

OpenClaw ClawScan processing logic error vulnerability

OpenClaw ClawScan versions 0.1.6 and earlier have a processing logic vulnerability. This vulnerability stems from improper operation of the shouldSkipTargetPath function in the internal/runner/runner.go file of the Static Scanner component, which may lead to the failure of the protection mechanis...

Hitachi Vantara Remote Ops Agent Authorization Vulnerability

The Hitachi Vantara Remote Ops Agent versions 1.6.0 to 2.0 have an authorization issue vulnerability. This vulnerability arises from the lack of rate limiting on attempts to input the reset code after the password reset function is enabled and the email configuration is set. This could allow...

Yiyi Wang Crossnote Cross-site Scripting Vulnerability

Yiyi Wang’s Crossnote version prior to 0.8.30 has a cross-site scripting vulnerability. This vulnerability stems from reading the content of crossnote/head.html and inserting a preview webview document during processing of resolvePathsInHeader. The executable content is not removed after...

Kedacore KEDA: Permissions management and access control vulnerabilities

KEDACORE KEDA 2.20.2 and earlier versions have security vulnerabilities. This vulnerability arises from the ability of the namespace administrator to create TriggerAuthentication and ScaledObject resources, thereby setting hashiCorpVault.address as a tenant-controlled endpoint. By selecting...

WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability

WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...

M A Vinoth Kumar Frontend Dashboard: Permissions, Licenses, and Access Control Vulnerabilities

The M A Vinoth Kumar Frontend Dashboard 3.0.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.97, as well as versions from 9.0.0 to 9.10.2-alpha.6, have a vulnerability related to improper exception handling. This vulnerability arises from errors that occur when sending verification emails or password reset emails. Attackers only...

OpenSIPS buffer error vulnerability

OpenSIPS versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 4.0.0, and 4.0.1 have a buffer error vulnerability. This vulnerability stems from the operation of the rtpproxyoffer/rtpproxyanswer functions in the rtpproxy component, which leads to out-of-bounds read access. This...

GStreamer buffer error vulnerability

GStreamer has a buffer error vulnerability. This vulnerability stems from the DCI parsing function in GStreamer’s H.266 codec parsing library, which incorrectly accepts reserved field values, leading to out-of-bounds writes and potentially causing crashes or memory corruption...

Portkey Gateway server request forgery vulnerability

Portkey Gateway version 1.14.0 to 1.15.2 has a server-side request forgeing vulnerability. This vulnerability arises from the isValidCustomHost function, which trusts the localhost-style host when TRUSTEDCUSTOMHOSTS is not set. Additionally, the x-portkey-custom-host header is not validated. As a...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.190 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postimages fileinfo2 = title' parameter. It may lead to storage-based cross-site scripting attacks. Certified...

LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability

LatePoint – a calendar booking plugin for appointments and events. Versions 5.7.2 and earlier have an authorization issue vulnerability. This vulnerability arises from calling the OsCustomerHelper::createwpuserforcustomer helper function from the publicly exposed processstepcustomer step. When th...

Ravi Teja Online-Examination-System Information Leak Vulnerability

Ravi Teja Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 and previous versions have a security vulnerability. This vulnerability stems from operations on an unknown function in the dbtables.sql file, which can be exploited remotely, leading to information leakage...

Hitachi Vantara Remote Operations Agent encryption vulnerability

The Hitachi Vantara Remot Ops Agent versions 1.60 to 2.0 have encryption-related vulnerabilities. These vulnerabilities stem from the use of the default self-signed SSL certificate for signing JWT access tokens for the web interface. Attackers can exploit this default certificate to issue JWT...

WordPress Jeg Kit for Elementor Authorization Issue Vulnerability

The WordPress JEG Kit for Elementor 3.2.19 and earlier versions has an authorization issue vulnerability. This vulnerability stems from the lack of permission checks for the two AJAX operations called ‘jkitpostblock’ and ‘jegfindauthor’. This could allow authenticated attackers with...

Rakuten Mobile Rakuten Mini Trust Management Vulnerability

Rakuten Mobile and Rakuten Mini have vulnerabilities related to trust management. These vulnerabilities stem from the use of the Android Verified Boot AVB feature with AOSP test keys. Attackers could potentially install modified system images by physically accessing affected devices...

WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities

WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...

Yiyi Wang Crossnote Command Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.28 contain a command injection vulnerability. This vulnerability stems from the handling of preview links, which pass the decoded link target to the Windows file open helper program. This program uses the start command to call childprocess.exec. When...

Hyyan WooCommerce Polylang Integration SQL Injection Vulnerability

Hyyan WooCommerce Polylang Integration 1.5.0 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the variationid parameter in the woocommerceremovevariations AJAX operation, as well as inadequate preparation of existing SQL queries. This...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

Siemens RUGGEDCOM CROSSBOW information leakage vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a vulnerability related to information leakage. This vulnerability stems from insufficient restrictions on access to various database queries. It may allow authenticated attackers to retrieve system-wide information beyond their authorized...

Unstructured output processing vulnerability

Versions of Unstructured prior to 0.24.1 contain security vulnerabilities. These vulnerabilities stem from the fact that the partitionhtml and VLM partitioner retain untrusted document tags, attributes, texts, and link targets in metadata.textashtml. Additionally, the tohtml function in...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...

WordPress Ad Inserter has a vulnerability related to information leakage

WordPress Ad Inserter 2.8.18 and earlier versions have a vulnerability involving information leakage. This vulnerability stems from the aiwpfooterhook, which exposes sensitive information. It is possible for authenticated attackers with privileges at the subscriber level or higher to extract...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of inputs when processing facility names in batch import/export workflows. It may allow authenticated attackers with specific privileges to execute...

Siemens RUGGEDCOM CROSSBOW authorization issue vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have an authorization issue vulnerability. This vulnerability stems from the failure to properly restrict access to sensitive configuration items through specific database queries. As a result, authenticated attackers may obtain administrative...

TechSmith MP4V2 has vulnerabilities related to improper exception handling.

The Techsmith MP4V2 2.0.0 version has a vulnerability in exception handling. This vulnerability stems from a null pointer dereferencing in the src/mp4file.cpp function, MP4File::GenerateTracks. This could allow a remote attacker to cause a denial-of-service attack...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of the input values for the Name and Value fields of custom file tags. This allows attackers with authenticated and administrator privileges to...

Ravi Teja Online-Examination-System Processing Logic Vulnerability

Ravi Teja Online-Examination-System has a processing logic vulnerability. This vulnerability stems from the Session::checkLogin function in the include/session.php file within the Session Handler component. The function manipulates the parameters cookname/cookid, leading to incorrect comparisons...

The-40-Thieves obsidian-tc backend link vulnerability

The The-40-Thieves obsidian-tc versions before 1.3.1 have a security vulnerability. This vulnerability stems from reading the access control list, where the check for lexical paths includes checking resolved paths as well. This allows symbolic links within libraries that are allowed by wildcarded...