CVE Vulnerability Catalog

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to and including 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user-controlled key. This allows authenticated attackers with author level access and above to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4.

The vulnerability is due to improper neutralization of input during web page generation (Cross-site Scripting, CWE-79). An authenticated user can render HTML tags within a user's browser via the integration package upload functionality.

Improper authentication in the Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. An attacker would need such a certificate signed by a trusted CA.

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges. In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions. This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.

Zohocorp ManageEngine ADManager Plus before version 8025 is vulnerable to NTLM Hash Exposure. This is exploitable only by technicians with the "Impersonate as Admin" option enabled.

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application.

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action. This may lead to unauthorized file uploads to the server.

In MISP before version 2.5.28, there is an XSS vulnerability in app/View/Elements/Workflows/executionPath.ctp, allowing for the injection of malicious code in the workflow execution path.

A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /fsnotify of the POST Message Handler component. Manipulation of the argument token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A path traversal flaw was found in Smartbit CommV Smartschool App up to 10.4.4, affecting an unknown function of the be.smartschool.mobile.SplashActivity component. The attack requires local access, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

The Lightweight Accordion plugin for WordPress up to version 1.5.20 contains a stored Cross-Site Scripting (XSS) vulnerability in the 'lightweight-accordion' shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes.

A path traversal vulnerability was detected in Municorn FAX App 3.27.0 on Android, affecting unknown code of the biz.faxapp.app component. The attack requires local access, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

A path traversal weakness was identified in atlaszz AI Photo Team Galleryit App 1.3.8.2 on Android, affecting an unknown part of the gallery.photogallery.pictures.vault.album component. The attack requires local access, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

A vulnerability in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3 affects an unknown functionality in the file /api/GylOperator/UpdatePasswordBatch, leading to weak password recovery. The attack may be initiated remotely. The exploit is publicly available. The vendor was contacted but did not respond.

A vulnerability was found in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. The function html_renderer in the file plugins/html_renderer/index.js of the Inter-plugin API component is affected. Manipulation of the action argument can lead to dynamically-managed code resources. The attack can be launched remotely.

A vulnerability was found in ketr JEPaaS up to 7.2.8. It impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Manipulation of the argument keyWord results in SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early but did not respond.

A vulnerability in Ugreen DH2100+ up to version 5.3.0 affects an unknown function of the USB Handler component. Manipulation leads to symlink following. The attack can be executed directly on the physical device, and the exploit has been publicly disclosed.

openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.