CVE Vulnerability Catalog

Backend users with file write permissions can upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass Form Framework restrictions. Malicious files can execute arbitrary SQL statements, allowing privilege escalation by creating admin accounts.

Non-privileged backend users with file mount access can perform write operations on folders representing the root of an active file mount due to missing authorization restrictions.

Backend users with access to the Form Framework can use files not ending in .form.yaml as form definitions, which are processed without denying the incorrect extension. Malicious form definition files can execute arbitrary SQL statements, enabling privilege escalation and admin account creation.

SINEC INS (all versions prior to V1.0 SP2 Update 6) uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and an insufficient number of iterations. This allows an attacker to efficiently recover user passwords using brute-force or precomputed attacks (e.g., rainbow tables).

In SINEC INS prior to V1.0 SP2 Update 6, a binary is configured with the cap_dac_override capability, bypassing file system permission checks. A local attacker can escalate privileges, modify arbitrary files, and gain root access.

In SINEC INS versions prior to V1.0 SP2 Update 6, user input is not properly sanitized in the /api/sftp/uploadFiles endpoint, allowing injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved.

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code. This enables theft of administrative access tokens and session credentials.

A vulnerability in SIMATIC WinCC Unified PC Runtime (versions V16 through V21 before V21 Update 2) is due to insufficient protection of key material in the WinCC Certificate Manager, which could allow an attacker to extract sensitive information.

The Blocksy theme for WordPress up to version 2.1.35 is vulnerable to PHP Object Injection leading to Remote Code Execution. Insufficient input sanitization and unconditional deserialization during V200 migration allow authenticated attackers with contributor-level access to inject a serialized object that executes arbitrary PHP code upon deserialization.

The Events Calendar for GeoDirectory plugin for WordPress up to version 2.3.28 has a privilege escalation vulnerability. The ajax_ayi_action() handler does not properly sanitize the 'type' and 'postid' parameters, allowing an authenticated attacker with Subscriber-level access to escalate to Administrator by passing type=wp_capabilities and postid=administrator.

In the Bluetooth host stack, during L2CAP LE CoC SDU reassembly, a remote unauthenticated BLE peer can trigger a 2-byte out-of-bounds write. This occurs when segmentation is enabled and the chosen RX pool has user_data_size smaller than 2 bytes, causing the segmentation counter to be written out of bounds in l2cap_chan_le_recv_seg.

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in the `recover_exit()` function. This makes it possible for unauthenticated attackers to perform path traversal and include unintended local PHP files, which can lead to sensitive information exposure and, in certain deployment chains, code execution.

The 6Storage Rentals plugin for WordPress up to version 2.22.0 allows unauthenticated attackers to read and modify tenant profile data (including name, email, phone, address, and SSN) via the userId parameter in AJAX actions six_storage_get_user_info and six_storage_update_profile. No ownership, session, or nonce validation.

In an untrusted JMS environment, MappingJackson2MessageConverter and JacksonJsonMessageConverter in Spring Framework allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Vulnerability in Spring Framework allows a DoS attack via specially crafted SpEL expressions, causing excessive resource consumption.

An integer overflow vulnerability exists in the Spring Expression Language (SpEL). An attacker can supply a specially crafted SpEL expression causing excessive resource consumption, leading to a Denial of Service (DoS).

The JavaScriptUtils.javaScriptEscape() function in Spring Framework incorrectly escapes data, potentially leading to JavaScript code injection in the browser and an XSS vulnerability. Affected versions: 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password, allowing authentication without a valid password.