CVE Vulnerability Catalog

Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.

Denial of service vulnerability in SurrealDB before version 3.1.0, in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

Vulnerability in SurrealDB before 3.1.5 in the DEFINE ANALYZER mapper filter allows arbitrary file read. Users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying paths in the filter and retrieving content via error messages when SURREAL_FILE_ALLOWLIST is empty or unconfigured.

Vulnerability in SurrealDB before version 3.2.0 allows authenticated users to access custom API endpoints in other namespaces/databases, potentially leading to reading sensitive data or unauthorized operations.

In _connect.BRAIN prior to version 5.06, the LogPathConfig.exe application is executed during setup, deleting existing permissions on %ProgramData% and replacing them with full control for the Everyone group, instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with version 5.06, the setup no longer runs this tool.

In BRAIN2 prior to version 3.09, the LogPathConfig.exe application is executed during setup, granting the Everyone group full control over %ProgramData% instead of restricting access to %ProgramData%\Bizerba\BRAIN2\. Starting with version 3.09, the setup no longer runs this tool, but the optional Bizerba ScriptService still executes it. ScriptService is deprecated and will not be included from version 3.11.

Authenticated OS command injection vulnerability in the system_certificates view, exploitable by a high-privileged remote attacker. Improper neutralization of special elements leads to total loss of confidentiality, availability, and integrity.

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. It silently falls back to a built-in rand-derived session id, which has low entropy and is easily guessed. Predictable session ids could allow an attacker to gain access to systems.

The Tag Groups WordPress plugin before version 2.2.0 improperly escapes one of its AJAX parameters before reflecting it in the response body served with an HTML content type. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.

A vulnerability in the Crypt::Password library for Perl (versions up to 0.28) allows timing attacks. The check_password method uses the eq operator, enabling attackers to guess the hash based on response time discrepancies.

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before version 1.4.1 does not enforce rate limiting or account lockout for passwordless email OTP verification, and stores short numeric codes in plaintext. An unauthenticated attacker who knows a registered email address can brute-force the code and log in as that user, including an administrator, leading to full site takeover.

The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

The SlimStat Analytics WordPress plugin before version 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator viewing the reports. Exploitation requires the plugin to be configured with the Cloudflare geolocation provider.

The Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins before version 7.34.0 do not sanitize and escape a request parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. This leads to an unauthenticated SQL injection vulnerability allowing attackers to extract sensitive data from the database.

The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.

In Meshtastic prior to version 2.7.23.b246bcd, a single node advertising a User.long_name with malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The issue arises from accidental null terminator placement in a multibyte sequence during buffer truncation, poisoning the node database.

Keras version 3.15.0 has an unsafe deserialization vulnerability of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method calls `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in. Outside a `SafeModeScope(True)` context, unsafe deserialization is allowed by default, potentially leading to arbitrary code execution.

In the Linux kernel, a potential out-of-bounds access was found in the AMD IOMMU debugfs interface. The iommu_mmio_write() and iommu_capability_write() functions used kstrtou32_from_user() for input parsing, which could convert large values into negative integers, leading to out-of-bounds memory reads/writes.

A vulnerability in the Linux kernel's __vm_normal_page() function mishandles missing support for pmd_special()/pud_special() on 32-bit x86 systems with THP enabled. This triggers warnings, RSS counter bugs, and page state corruption during memory reclaim.