CVE Vulnerability Catalog

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 uses a predictable/forgeable order access token. Anyone who obtains the site's Joomla secret can compute a valid access token for any order without placing one, gaining guest access to order details and digital downloads.

In the Joomla extension J2Store, any order can be marked Failed by anyone without authentication. An attacker can mass-fail pending orders to disrupt revenue and force manual reprocessing, or flip already-fulfilled orders back to FAILED to cause operational confusion. Unlike the earlier confirmation-fraud issue, this requires no correct payment amount or transaction data at all.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The activate_files() action created PageTemplate records from attacker-supplied values without validating an anti-CSRF token. A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session, changing site configuration without consent.

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user with access to the bulk SEO tool and view (but not edit) permission could change the page's meta title, meta description, and URL handle, tampering with presentation and live URLs of protected content.

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page. An authenticated user with sitemap access but no edit or arrange rights could still move the page and alter the site's global navigation order.

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could continue to mint valid access tokens after being deactivated or suspended (uIsActive=0), so deactivating an account did not revoke its API access.

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list without validating the anti-CSRF token or restricting the request to POST. A remote attacker could lure an authenticated user with SEO access to a crafted page, reverting the reserved-word list to default and silently altering future URL-slug generation.

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method. An attacker could induce a signed-in content editor into loading an attacker-controlled page that auto-submitted a cross-site request and reordered or moved blocks in the draft version of a page.

In the Joomla extension J2Store, J2StoreModelOrderdownloads::getFilePath() built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored product_file_save_name, using only JPath::clean() (which normalises separators but does not resolve or reject .. segments) and a plain JFile::exists() check. If a product file's product_file_save_name contained a ../ traversal segment, any customer holding a valid download token/pid pair could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. configuration.php).

The Joomla extension J2Store (versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7) contains an unauthenticated blind SQL injection vulnerability in the storefront product list. An attacker can remotely extract arbitrary database content, such as customer records, order data, or stored tokens, using boolean- or time-based inference.

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint does not verify that the actor is permitted to grant the requested role, does not prevent a user from changing their own role, and does not restrict assignment to roles whose permission set is a subset of the actor's own.

In Webkul Bagisto v2.4.9, improper validation of the quantity parameter in the add-to-cart path allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

The Joomla extension J2Store (versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7) lacks CSRF protection on cart, checkout, and profile controllers. A forged request riding a victim's active session can silently overwrite billing or shipping address before order confirmation, potentially redirecting goods to an attacker-controlled address.

On Arista EOS platforms, under certain circumstances, plaintext shared secrets for configured TACACS+ servers may be exposed. The issue affects systems running Arista EOS.

On Arista EOS platforms, under certain circumstances, user passwords may be written in cleartext to log files when specialized non-standard debugging trace levels are explicitly enabled. Exploitation requires authenticated local administrative access to the device shell.

On Arista EOS platforms, under certain circumstances, plaintext private keys may be written in cleartext to log files when specialized non-standard debugging trace levels are explicitly enabled. Exploitation requires authenticated local administrative access to the device shell.

On Arista EOS platforms with dual switch cards and ingress Security ACLs configured on shared-mode Switched Virtual Interfaces (SVI), restarting the secondary switchcard forwarding agent or inserting the secondary switchcard can cause Security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember's chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data without re-encoding and interprets malformed chunk boundaries differently, an unauthenticated attacker can create TE.TE request smuggling that bypasses intermediary controls, poisons caches, or hijacks the request queue.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the CookieJar client middleware stores a response cookie's Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies.