CVE Vulnerability Catalog

Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials.

Weblate prior to version 5.15 does not validate or sanitize the repository URL field in the Create Component functionality, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost and internal network addresses. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL, creating a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. Additionally, error messages enable local file enumeration via file:// requests, and in cloud environments internal-only endpoints such as cloud metadata services may be accessible.

In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x, displays the full server stack trace when encountering an error within the GetCdfResource servlet. This may reveal technical details of the environment.

A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.

A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.

IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated, potentially enabling unauthorized access under certain network conditions.

IBM UCD - IBM DevOps Deploy versions 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token.

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

An integer overflow exists in the Bluetooth Host stack within the bt_br_acl_recv routine, a critical path for processing inbound BR/EDR L2CAP traffic. The flaw affects a critical data processing path.

The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4 registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null, so a broadcast with extras but without EXTRA_CHOSEN_COMPONENT causes a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application can send crafted ACTION_SEND broadcasts to repeatedly crash the host application.

An HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.

A vulnerability in Hitron HI3120 version 7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in index.html.

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 4.3.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to and including 2.13.3. Authenticated attackers with Author-level access and above can add images to arbitrary Modula galleries owned by other users.

The OneSignal – Web Push Notifications plugin for WordPress up to version 3.6.1 is vulnerable to unauthorized data modification due to missing capability check on settings handling. Unauthenticated attackers can overwrite OneSignal App ID, REST API key, and notification behavior via direct POST requests.

The FluentAuth – The Ultimate Authorization & Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to and including 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The CC Child Pages plugin for WordPress up to version 2.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the 'child_pages' shortcode. This is due to insufficient input sanitization and output escaping on four user-supplied attributes in the 'show_child_pages' function.

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress (all versions up to and including 4.4.6) is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes due to insufficient input sanitization and output escaping. An authenticated attacker with contributor level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.