CVE Vulnerability Catalog

Cotonti 1.0.0 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. The configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers.

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 5.0.0, allowing unauthenticated attackers to make web requests to arbitrary locations originating from the web application.

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 1.10.2 via the 'account-id' parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, allowing authenticated attackers with author-level access to execute code on the server.

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module.

The E2Pdf – Export Pdf Tool for WordPress plugin is vulnerable to Missing Authorization in versions up to and including 1.32.26. The screen_action() function lacks a dedicated capability check and nonce verification, allowing attackers to overwrite WordPress options.

TypeBot is a chatbot builder tool that in versions prior to 3.17.2 has a vulnerability in SSRF validation. The issue is that the IP validation is not properly tied to subsequent requests, allowing attackers to exploit DNS rebinding to bypass protections.

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).

TypeBot is a chatbot builder tool that has an Insecure Direct Object Reference vulnerability in versions 3.15.2 and below. This allows authenticated users to modify or delete theme templates from other workspaces.

LiquidJS is a Shopify/GitHub Pages compatible template engine that in versions 10.25.7 and below contains a flawed regex in the strip_html filter. This leads to ReDoS attacks via quadratic backtracking, blocking the Node.js event loop.

In versions 10.25.7 and below of the LiquidJS template engine, a vulnerability exists related to the date filter that improperly processes width specifiers, leading to unbounded string concatenation and bypassing memory and render limits.

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers do not verify the SystemBuffer pointer before dereferencing it. Sending an IOCTL with an empty input buffer causes a NULL pointer dereference, resulting in a kernel crash.

In versions prior to 4.2.0 of Steeltoe.Management.Endpoint and 3.4.0 of Steeltoe.Management.EndpointCore, the `Sanitizer` component improperly masks configuration values, allowing full connection strings to be exposed in `/actuator/env` responses. The default suffix list does not cover the standard .NET pattern `ConnectionStrings:<name>` or `Steeltoe:Client:<type>:Default:ConnectionString`.

In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, the `DataCenterInfo.FromJson` method throws an `ArgumentException` for any `name` value other than 'MyOwn' or 'Amazon', leading to issues with service registry deserialization.

Steeltoe is an open source project that provides libraries for building cloud-native applications. In versions 3.2.2 through 3.3.0 and 4.1.0, when management endpoints are configured to listen on an alternate port, the middleware uses the `Host` HTTP header instead of the actual network socket port, leading to potential security vulnerabilities.

e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.

In versions prior to 0.7.5 of the Windows-MCP project, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS. This allowed attackers to remotely execute PowerShell commands as the Windows user.

The install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 has improper neutralization of argument delimiters, which may allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

The PHP Standard Library (PSL) has a vulnerability in versions 6.1.0, 6.1.1, and 6.2.0 related to the lack of validation of the total bytes received in DATA frames against the content-length header in HEADERS frames, allowing request smuggling. A malicious client can send more or fewer DATA bytes than declared, leading to incorrect application behavior.

Tinyproxy through version 1.11.3 fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on the packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.