CVE Vulnerability Catalog

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Extensions for Leaflet Map plugin allows Stored XSS. This issue affects Extensions for Leaflet Map through version 6.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress ND Shortcodes For Visual Composer plugin allows Stored XSS. This issue affects ND Shortcodes For Visual Composer through version 7.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Waitlist Woocommerce (Back in stock notifier) plugin allows Stored XSS. This issue affects Waitlist Woocommerce (Back in stock notifier) through version 2.9.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin allows Stored XSS. This issue affects Restaurant Menu – Food Ordering System – Table Reservation through version 2.4.4.

The ЮKassa for WooCommerce plugin is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.17.3.

The myCred plugin is vulnerable to authorization bypass through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.0-beta.1.

The Page Restriction WordPress (WP) plugin by miniOrange is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.6.0.

The WP Desk ShopMagic plugin (shopmagic-for-woocommerce) has an insertion of sensitive information into an externally-accessible file or directory vulnerability, allowing retrieval of embedded sensitive data. This issue affects ShopMagic versions up to and including 4.9.1.

The WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) up to version 0.5.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User-supplied data is not properly sanitized, allowing malicious scripts to be stored.

The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The Majestic Support plugin by Ahmad Majestic, versions up to 1.2.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress Sunshine Photo Cart plugin (through version 3.7.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit. A deeply nested JSON document of about 20 KB causes a raw java.lang.StackOverflowError instead of a JSONException, failing the parsing thread.

The SureDash plugin by Brainstorm Force is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.12.2.

The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, leading to heap memory corruption and a crash of the web server process.

The WordPress plugin Elementor Addon Elements up to version 1.14.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious input can be stored and executed in a user's browser.

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PowerPack Addons for Elementor from n/a through 3.1.0.