CVE Vulnerability Catalog

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".

AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings.

The Car Rental Manager plugin by Magepeople contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.5.3.

The Knit Pay plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 9.6.3.0.

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code that executes in the victim's browser when visited, allowing theft of session cookies and actions performed on behalf of the victim within the application.

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3; version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected.

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.

The ASMobile web interface in the VertiGIS GIS Portal package allows authenticated users to define a business reference into which JavaScript code can be inserted. On its own this is self-XSS, but the business reference is included in order details and later displayed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the code executes when a highly privileged user opens the order.

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the searchValue URL parameter, so the search is performed when a logged-in user opens such a URL, and JavaScript code in this parameter executes in the victim's browser.

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage employees of defined companies (user groups). User properties such as the "secondName" parameter can be filled with JavaScript code while editing a user; the code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected; the vendor did not provide information about further affected versions.

An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana allows an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. This enables unauthorized access to the device.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not validate or escape some form shortcode attributes that can take values from the visitor's request and are output without escaping. This allows users with a role as low as contributor to run arbitrary script in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292.

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension. This allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message. This could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed. This allows a site administrator who is not a Super Admin to create or overwrite network-wide options.

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API. This allows unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public. This allows unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.

The Otter Blocks WordPress plugin before version 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet. This allows users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.