CVE Vulnerability Catalog

The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges. The administrator role is protected, but attackers can also enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments.

Kernel software running inside a Guest VM can send improper commands to the GPU firmware, causing out-of-bounds memory writes outside the guest's virtualized GPU memory.

Kernel software running inside a Guest VM can send improper commands to the GPU firmware, triggering out-of-bounds memory accesses. This can be used for privilege escalation escaping virtualization boundaries.

Software run by a non-privileged user can issue improper GPU system calls to manipulate the lifetimes of synchronization objects in the kernel, leading to read/write use-after-free (UAF) conditions.

The GeoVision GV-IP Device Utility desktop application is vulnerable to DLL hijacking. It loads DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library.

The WowOptin: Next-Gen Popup Maker WordPress plugin before version 1.4.38 lacks proper authorization on a REST endpoint, allowing unauthenticated users to disable all opt-in forms and insert new template-based opt-in rows into the database.

In Rapid7 InsightVM, Nexpose, and Insight Agent, discovered executables are executed during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent).

The CAFEHAUS API WordPress plugin up to version 1.0.0 lacks authentication or authorization when updating user passwords. An unauthenticated attacker can set the password of any user, including administrators, and fully take over their accounts.

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before version 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.

Multiple security vulnerabilities in Snowflake libsnowflakeclient prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution. A related out-of-bounds write could allow memory corruption. Improper validation of connection parameters could redirect authentication requests to an attacker-controlled endpoint.

In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.

In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.

In OpenStack Ironic Python Agent through version 11.6.0, a project-scoped user with the manager role can achieve remote code execution via a maliciously crafted configuration. The ntp_server value is passed to a shell without sanitization.

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options.

Server-side request forgery (SSRF) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

Pronetiqs IntraVUE versions 3.2.1a14 and prior expose sensitive system information to unauthorized entities, potentially revealing host/share files.

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.