CVE Vulnerability Catalog

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post. This allows unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. Malformed input can cause a read beyond buffer boundaries.

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details. This allows unauthenticated attackers to view another customer's order using the order's key.

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action. This allows Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read. This allows users with contributor-level access and above to retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them.

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user. This allows someone who holds another member's in-flight payment identifier to delete that member's checkout state.

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, which happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions, can rewrite the saved field configuration of any form, including a live payment form.

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

A security flaw in JusticeRage Manalyze 1.0.0. The function PE::_parse_relocations in manape/pe.cpp of the PE Parser component is affected. Manipulating the BlockSize argument results in integer underflow. The attack requires local access. A patch named c372b6bbca9d8c63812be50596fefa4a79c65fd0 is recommended.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template renders user-controlled values without HTML escaping, allowing a project member to inject HTML into an approver's notification, enabling forged links, tracking content, or visually altered email content. Fixed in version 8.0.3.

wlc is a Weblate command-line client. Prior to 2.0.1, automatically discovered configuration can select the API URL while an unscoped API token is supplied without a matching URL. When wlc runs in an untrusted repository, it can send the token to an attacker-controlled URL. URL-scoped keys are not affected. Fixed in version 2.0.1.

A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/', the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

Dark Reader before version 4.9.126 (for Firefox) or 4.9.128 (for other browsers) allows a website to trigger a request to a locally running server through the image inversion pipeline when a resource uses a known public HTTPS URL and is detected as requiring inversion. This can cross the website-to-local-network boundary and disclose limited information about the resource.

hexpm (hex.pm) has a vulnerability of insufficient session expiration in OAuth tokens. A user whose organization membership or session has ended can still read the organization's private packages and documentation via a retained refresh token. Access is read-only and limited to organizations the account belonged to when the token was granted.

radare2 before version 6.2.0 has a vulnerability in the Mach-O LC_DATA_IN_CODE parser that trusts dataoff and datasize, potentially leading to a heap out-of-bounds read when processing a crafted file. The attack requires the bin.verbose option to be enabled. It may cause process termination, but no memory disclosure has been demonstrated.

radare2 before version 6.2.0 has a vulnerability in the Lua 5.3 bytecode function parser that reads fixed metadata fields without checking remaining buffer length. When opening a crafted file with a function name ending at the buffer boundary, the parser reads beyond allocated memory, possibly causing incorrect results or process termination.