CVE Vulnerability Catalog

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, AC700, AC800, and AC900. This issue affects versions through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1.

A flaw in Netty's HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service by sending HTTP/2 SETTINGS frames with an excessively large MAX_HEADER_TABLE_SIZE. This leads to excessive storage of headers, increasing CPU and memory usage.

A flaw in Netty's HttpServerCodec allows a remote, unauthenticated attacker to pipeline HTTP/1.1 requests and withhold reads, causing the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and denial of service.

In Netty, SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and denial of service.

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers.

A vulnerability in Netty's OCSP client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage in OCSP responder certificates. A remote attacker holding any valid certificate from the same CA can forge 'GOOD' OCSP responses for revoked certificates, bypassing revocation checks.

A flaw in Netty's MqttDecoder. An unauthenticated remote attacker can send a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing bypass of size limits.

A flaw in Netty's `RedisArrayAggregator` component. A remote attacker can send specially crafted nested Redis (RESP) array headers. This causes `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory.

A flaw in Netty's `SmtpResponseDecoder` component. A remote attacker acting as a malicious or man-in-the-middle (MITM) SMTP server can send a specially crafted, unbounded multi-line SMTP response without a terminator. This leads to unbounded memory accumulation within the client's JVM heap.

In io.netty/netty-codec-memcache, the Memcache binary protocol codec reads keyLength and extrasLength as signed Java types instead of unsigned as specified. A malicious Memcache server can exploit this by sending a crafted response, leading to frame desynchronization and response smuggling.

A flaw in QEMU's VAPIC setup hypercall does not validate that the writable RAM alias remains within the option ROM window. A privileged guest on a Q35/KVM machine can position this alias over locked SMRAM, bypassing D_LCK protection and injecting code into SMM memory.

A stored Cross-Site Scripting (XSS) vulnerability exists in the profile management functionality of T-Systems' TAO 2.0 suite. An authenticated user can inject malicious HTML or JavaScript into personal data fields, which are displayed without proper sanitization to other users, including administrators.

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to and including 10.8.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts.

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the values[Name] parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.