CVE Vulnerability Catalog

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket without service-level authentication. WebSocket origin validation is fail-open, allowing attackers to execute arbitrary OS commands.

A Path Traversal vulnerability in the Apache Lucene.Net.Replicator library allows unrestricted file reading outside the restricted directory. The issue affects versions from 4.8.0-beta00005 through 4.8.0-beta00017.

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

A Path Traversal vulnerability in the Lucene.Net.Replicator library allows unauthorized access to files outside the restricted directory. Affected versions are from 4.8.0-beta00005 to 4.8.0-beta00017.

A vulnerability in libcurl allows accepting an untrusted server during SCP or SFTP transfers when using the CURLOPT_SSH_KEYFUNCTION callback. The server can present a host key type different from the one recorded in the known_hosts file, and the callback mechanism fails to enforce rejection, allowing the connection to succeed without warning.

In libcurl, the HTTP `Referer:` header persisted even when explicitly cleared. Although the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state, so the previous referrer string was erroneously reused and sent in subsequent requests.

A vulnerability in libcurl allows sending the second request's data before enforcing certificate verification when SSL session caching and early data are enabled. This occurs when the target server is replaced by an attacker's impostor machine.

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability. libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. Specifically, options related to the private key were left out from the configuration match checks.

A vulnerability allows reusing an existing live connection for a new transfer using STARTTLS even when the TLS configuration mismatches, potentially leading to unauthorized access or man-in-the-middle attacks.

In IMS, a vulnerability allows out-of-bounds read due to missing bounds check. This could lead to remote denial of service without requiring additional execution privileges.

A vulnerability in curl causes the tool layer to skip initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS when using a schemeless URL with `--proto-default sftp` (or scp), while libcurl establishes the SFTP/SCP connection. This results in curl connecting to an unverified SSH remote host without error.

Curl lacks an upper bound on memory allocation for unacknowledged WebSocket PING frames, allowing a malicious server to exhaust all available memory by sending rapid sequential PING messages.

A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service (DoS) against a curl or libcurl client. The helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, enabling a connected QUIC peer to continuously stream empty datagrams and indefinitely stall the client.

The AR for WooCommerce plugin for WordPress up to version 8.40 is vulnerable to Directory Traversal via the 'file' parameter. Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information. Three access controls fail: nonces are generated without authentication, the AES-256-CBC encryption key is predictable, and the Referer check is easily bypassed.

The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.

A vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. The issue stems from external control of file name or path.

The unsupported ASUS AI Suite 3 driver contains a vulnerability due to improper validation of a specified quantity in input. A local user can bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation.

The unsupported ASUS AI Suite 3 driver contains a vulnerability due to improper validation of specified quantity in input, allowing a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation.

The AR for WordPress plugin up to version 8.40 is vulnerable to Directory Traversal via the 'file' parameter. An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information.