CVE Vulnerability Catalog

In GIMP, when processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

The YOP Poll plugin for WordPress up to version 7.0.10 is vulnerable to Origin Validation Error. The plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This allows unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page.

Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. The vulnerability may allow unauthorized users to access functions or data they should not have access to.

Path Traversal vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to access files outside the intended directory.

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

Authorization bypass through a user-controlled key exists in DIAEnergie. The issue affects versions before 1.11.00.022.

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

Improper Authentication vulnerability in DIAEnergie before version 1.11.00.022 allows authentication bypass.

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress up to version 1.0.3 is vulnerable to Path Traversal via the `id2wp_path` parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

GPM LIGHT developed by ezGlobal has a sensitive data exposure vulnerability. Unauthenticated remote attackers can directly access system logs.

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.

A path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account.

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

This CVE has been rejected because it is a suggestion, not an actual vulnerability.

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.