CVE Vulnerability Catalog

The My Agile Privacy® plugin for WordPress up to version 3.3.6 contains an authorization bypass vulnerability. Unauthenticated attackers can modify plugin settings such as missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation.

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. The grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.

A vulnerability was found in liketrek TREK up to 3.0.22. It impacts the function loginUser in server/src/services/authService.ts of the Pre-2FA mfa_token Handler component. The manipulation results in improper authentication. The attack may be performed remotely. Upgrading to version 3.1.0 is recommended.

Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to the privileged uaa (system) identity zone, by referring to the zone identifier in a non-lowercase form (e.g. UAA) in the request path and body. The authorization layer performs a case-sensitive comparison against the system zone identifier, while the underlying MySQL persistence layer resolves identifiers case-insensitively under its default collation, so the request is authorized incorrectly and is then resolved against the real system zone record. This allows the attacker to overwrite the system zone's JWT signing key with attacker-controlled key material, forge JWTs claiming the admin client and administrator scopes, and fully compromise UAA and any Cloud Foundry deployment that trusts it. This issue only affects UAA deployments backed by MySQL using its default collation; PostgreSQL and HSQLDB backends are not affected.

SSRF vulnerability in Apache Hive before 4.2.1 allows an authenticated attacker with CREATE TABLE privilege to force the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url property for an Avro table. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity.

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session via a forged Authorization: Bearer token sent to the /cliservice HTTP endpoint. Users are recommended to upgrade to 4.2.1 version that includes the fix.

SQL injection vulnerability in Apache Hive before 4.2.1 affects partition-name resolution in Hive Metastore when direct SQL is enabled. An authenticated user can craft partition names in RPC requests to alter the WHERE clause, allowing read, modification, or impact on metadata of unintended partitions (e.g., statistics updates, truncate targets, file-metadata cache operations).

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.

Denial-of-service (DoS) vulnerability in the internal JPEG2000 (JPX) decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption. The flaw occurs in the JPXStream::readCodestream() function, where values controlled from the SIZ segment (such as img.nComps) are used for the memory allocation of tiles and components without adequate validation. This allows an attacker to force excessive memory allocation and cause a resource exhaustion, ultimately causing the pdftoppm process to terminate due to out-of-memory (OOM) conditions.

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 (exclusive) due to insufficient escaping on user-supplied parameters and lack of proper query preparation. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

The Kalles Addons plugin for WordPress up to version 1.0.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP object. No known POP chain exists in the vulnerable software, so the vulnerability has no impact unless another plugin or theme with a POP chain is installed.

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.5. This allows unauthenticated attackers to elevate their privileges to administrator level.

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute in all versions up to and including 3.5.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags.

A vulnerability in LACT (through 0.10.0) allows a local attacker to follow UNIX symbolic links, potentially leading to a local denial-of-service.

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.

In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

hbs is an Express view engine wrapping Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with the raw callback return value without escaping it. An application passing attacker-influenced data into an async helper callback can have arbitrary HTML and JavaScript injected into the server-rendered page, resulting in stored or reflected XSS. Versions 2.1.0 through 4.2.1 are affected, fixed in 4.3.0.

In affected versions of the Codefresh platform, an authenticated user can utilize an API endpoint to elevate to Admin permissions.