CVE Vulnerability Catalog

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses, exposing user data and allowing CSRF protection bypass and token theft.

Privilege escalation due to weak configuration while temporary file handling.

Privilege escalation due to weak configuration during package extraction process.

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

Exposed dangerous function lead to privilege escalation via gRPC server.

Improper authorization in the SocketIO interface leads to remote code execution. The vulnerability allows an attacker to execute arbitrary code on the server.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server.

This CVE was rejected as not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

The Taxi Booking Manager for WooCommerce plugin by Magepeople inc. contains an Authentication Bypass vulnerability using an alternate path or channel. This issue affects versions before 2.0.8.

The '/password/guardarClau/recover' endpoint accepts the 'usuariId' parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts.

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate. The attacker needs no certificate, private key, or prior session.

The ssh library in Erlang/OTP contains an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exhaust node memory by repeatedly opening session channels that are never assigned a handler. This affects OTP from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6).

A denial-of-service vulnerability in the Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder is caused by inefficient algorithmic complexity (quadratic) when processing very large subidentifiers. A remote unauthenticated attacker can send a crafted OID during the TLS handshake, causing prolonged CPU consumption (e.g., about 13 seconds for ~262 KB of data). The issue affects the BER, PER, and JER decoders in lib/asn1.

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.6.43 via the 'provider' parameter. An authenticated attacker with shop manager-level access or above can delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls.

The WP-CRM System plugin for WordPress in versions up to and including 3.4.6 is vulnerable to Sensitive Information Exposure via the 'contact_id' parameter. An authenticated attacker with contributor-level access or higher can enumerate this parameter to extract CRM contact data such as full names, email addresses, phone, mobile and fax numbers, and physical addresses.

A flaw was found in the Kerberos federation provider of Keycloak. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC), allowing an attacker on the same network to spoof the KDC and bypass authentication.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.