CVE Vulnerability Catalog

The Access code plugin for Drupal has a vulnerability due to improper restriction of excessive authentication attempts, allowing brute force attacks. This affects versions from 0.0.0 before 2.0.5.

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

Cryptographic validation of upgrade images could be circumvented by dropping a specifically crafted file into the upgrade ISO.

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes).

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 only allows IPv6 addresses in square brackets; IPv4 addresses and hostnames must not appear there. Parse did not enforce this requirement.

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows allows a local user to execute arbitrary commands with elevated privileges. This is an additional unmitigated attack path for CVE-2024-4944. The vulnerability is fixed in version 12.11.5 of the client.

An unauthenticated server-side request forgery (SSRF) vulnerability exists in the Thumbnail via-uri endpoint of Halo CMS 2.21. A remote attacker can force the server to make HTTP requests to attacker-controlled URLs, including internal network addresses.

In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object.

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.

The Premmerce Product Search for WooCommerce plugin (versions up to and including 2.2.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation.

The Blog Designer PRO WordPress plugin versions up to and including 3.4.8 has a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This could enable unauthorized actions.

The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1.

IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release.

IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. The values are stored and later rendered in the web interface without proper sanitation or encoding.

IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the txt_mailuser and txt_mailpass parameters when updating mail server settings. Values are stored and rendered without proper encoding.

IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the REMOTELOG_ADDR parameter when updating the remote syslog server address. The value is stored and rendered without proper encoding.

A flaw in Red Hat Openshift AI Service's TrustyAI component grants all service accounts and users cluster-wide permissions to get, list, and watch any pod in any namespace. It also allows access to all persistentvolumeclaims and lmevaljobs.