CVE Vulnerability Catalog

Vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.

A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This issue exists because authentication details are included in the encrypted backup files.

Multiple stored cross-site scripting (XSS) vulnerabilities were discovered in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1. Attackers can inject malicious JavaScript or HTML payloads into the First Name and Last Name parameters, leading to script execution in other users' browsers.

The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions up to, and including, 51.1.38. This is due to insufficient input sanitization and output escaping across multiple widgets and features. The plugin uses esc_attr() and esc_url() within JavaScript inline event handlers (onclick attributes), which allows HTML entities to be decoded by the DOM, enabling attackers to break out of the JavaScript context. Additionally, several JavaScript files use unsafe DOM manipulation methods (template literals, .html(), and window.location.href with unvalidated URLs) with user-controlled data. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via Elementor widget settings that execute when a user accesses the injected page or when an administrator previews the page in Elementor's editor. The vulnerability was partially patched in version 5.1.51.

OpenViking versions 0.2.5 through 0.2.13 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.

In the Linux kernel KVM subsystem for x86, a vulnerability was found where an existing shadow-present SPTE is not dropped before installing an emulated MMIO SPTE. This can cause a warning and potential misbehavior when host userspace modifies guest memory.

PowerStore contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.

Wykorzystanie po zwolnieniu pamięci w CSS w Google Chrome przed wersją 146.0.7680.178 umożliwia zdalnemu atakującemu wykonanie dowolnego kodu wewnątrz piaskownicy za pomocą spreparowanej strony HTML.

Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.3x before 5.1.*.

Claude SDK for Python versions 0.86.0 to before 0.87.0 has a vulnerability in the async local filesystem memory tool. Path validation is performed but the unresolved path is returned, allowing a local attacker to use symlinks to escape the sandbox.

Claude SDK for TypeScript versions 0.79.0 to before 0.81.0 contains a vulnerability in the local filesystem memory tool that validates model-supplied paths using a prefix check without appending a trailing path separator, allowing reads and writes outside the sandboxed memory directory.

In the Claude SDK for Python (versions 0.86.0 to before 0.87.0), the local filesystem memory tool creates memory files with mode 0o666, making them world-readable on systems with standard umask and world-writable in permissive umask environments like many Docker images. A local attacker on a shared host can read agent state, and in containers can modify memory files to influence model behavior.

FreeScout, a help desk system built with Laravel, has a bug in the checkIpByMask() function that checks if the input IP contains a '/' character. Plain IP addresses never contain '/', so the function always returns false without checking CIDR ranges. Private ranges 10.0.0.0/8 and 172.16.0.0/12 remain unprotected. Affects versions prior to 1.8.211.

FreeScout before version 1.8.211 has a host header manipulation vulnerability that allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. A fix is available in version 1.8.211.

cpp-httplib is vulnerable to HTTP Request Smuggling. The server does not consume the GET request body, and on keep-alive connections unread bytes are interpreted as a new request.

Nuxt OG Image before version 6.2.5 has a vulnerability in the image-generation component via URI /_og/d/ (and /og-image/ in older versions) that allows injection of arbitrary attributes into the HTML page body. A fix is available in version 6.2.5.

In XML Notepad for Windows prior to version 2.9.0.21, DTD processing is not disabled by default, allowing automatic resolution of external entities. An attacker can craft a malicious XML file that loads a DTD causing outbound HTTP/SMB requests, potentially leaking local file contents or capturing NTLM credentials. The issue is fixed in version 2.9.0.21.

A stored XSS vulnerability exists in SonicWall Email Security due to improper input neutralization. A remote authenticated admin user can execute arbitrary JavaScript code.

WWBN AVideo versions 26.0 and prior have an SSRF vulnerability in the EPG (Electronic Program Guide) feature. Authenticated users with upload permissions can store arbitrary URLs that the server fetches on every EPG page visit. Insufficient URL validation allows scanning internal networks and accessing internal services.

WWBN AVideo up to version 26.0 has a vulnerability in the User_Location plugin's testIP.php page that reflects the ip parameter without output encoding, allowing arbitrary HTML and JavaScript injection. Although the page is restricted to admins, the SameSite=None cookie configuration allows cross-origin exploitation. No public patches are available.