CVE Vulnerability Catalog

A vulnerability in Protegent 360 v2.0.0.4 by Unistal Systems allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys.

The IP Login extension for Joomla accepts client IP headers without requiring a configured trusted proxy. Attackers can spoof the IP used for automatic login and potentially impersonate mapped accounts.

Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.

The Joomla Regular Labs Extension Manager did not consistently check CSRF tokens or permissions during admin, install, update, and uninstall operations. An unauthorized backend user or CSRF attack could install, update, or remove extensions.

The DB Replacer extension for Joomla does not consistently require Super User permission or a valid token for administrator routes and replacement requests. An unauthorized backend user or CSRF attack can perform database replacements, potentially causing major data corruption or site compromise.

Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.

The Regular Labs conditions manager for Joomla! trusts spoofable forwarded headers for IP and GeoIP conditions, allowing remote clients to bypass location-based rules.

The Regular Labs Conditions Manager for Joomla did not consistently check CSRF tokens or component/mapped-item permissions during condition administration. An unauthorized backend user or CSRF attack could modify conditions.

AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

The OIDC::Lite Perl library up to version 0.12.1 allows ID Token signature verification bypass via a token-controlled algorithm allowlist. When the caller does not pin an algorithm, verify sets the algorithm from the token header and passes it to decode_jwt as the allowed list. A token with alg=none returns claims without signature check, and a token with alg=HS256 is verified with the RSA public key as HMAC secret (RS to HS confusion).

A vulnerability in the unrar.dll component of IZArc version 4.6 allows attackers to execute a path traversal attack.

An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism.

An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.

A vulnerability in CoffeeZip version 4.8.0.0 by OhSoft allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

In ExpressZip v11.29 by NCH Software, a vulnerability allows attackers to execute arbitrary code by downloading and running a crafted archive file.

Question2Answer through version 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access after a password reset, because the forgot-password flow does not clear the sessioncode field.

The MIME header parsing code in Thunderbird when forwarding a message (with the setting to view all headers enabled) has an off-by-one error, allowing a single byte to be read from memory after the header buffer, potentially crashing Thunderbird. Fixed in Thunderbird 153 and Thunderbird 140.13.

In Compass, when importing connections, it is possible to override connection options that normally cannot be changed via the connection form. In particular, a custom browser open command for OIDC auth flow can be provided, which is usually only set globally in Compass settings.

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.