CVE Vulnerability Catalog

A privilege escalation flaw exists in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs mysqld --validate-config --log-error-verbosity=2 directly as root, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql, setting plugin_dir and early_plugin_load so MySQL loads the attacker-controlled object during configuration validation. When an administrator subsequently runs the Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t).

A vulnerability in MISP arises from relying on CakePHP's request-method override processing, which can disable CSRF and form-security validation. CakePHP honors the _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the standard verbs (POST, PUT, PATCH, DELETE), CakePHP clears the request body, causing MISP to skip _validatePost() and _validateCsrf(). An attacker can send a form with _method=GET to bypass protections.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker, including the built-in worker. Incorrect permission validation during script execution allowed the script to run without the user having the required authorization.

A vulnerability in GPAC up to f1219cde affects the function gf_node_list_insert_child in scenegraph/base_scenegraph.c, leading to memory corruption. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended to resolve the issue.

A vulnerability was detected in GPAC up to f1219cde in the function gf_node_activate_ex in scenegraph/base_scenegraph.c, leading to a stack-based buffer overflow. The attack requires local access, and the exploit is public.

A vulnerability in GPAC up to f1219cde affects the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c, leading to use-after-free. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended.

A vulnerability in GPAC up to f1219cde affects the function gf_url_concatenate_ex in utils/url.c, leading to a heap-based buffer overflow. The attack must be approached locally. Upgrading to version abi-16.23 is recommended to address the issue.

In GPAC up to f1219cde, a flaw in the function gf_mo_get_od_id in compositor/media_object.c of the Compositor component can lead to use-after-free. The attack can be performed remotely, and the exploit has been published. Upgrading to version abi-16.24 resolves the issue.

A heap-based buffer overflow has been detected in GPAC in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The vulnerability can be exploited remotely and a public exploit is available. The issue is fixed in version abi-16.23.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0 in the move_uploaded_file function of production/edit_picture.php in the Profile Picture Upload component. Manipulating the File argument results in unrestricted file upload. The attack can be carried out remotely and a public exploit is available.

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, backing Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.7.7 via the 'mediaId' parameter due to missing validation on a user-controlled key. An authenticated attacker with subscriber-level access or above can access and retrieve transcribed contents of private audio attachments belonging to other users, including Administrators. The vulnerability requires the Public API module to be enabled.

The Eventin plugin for WordPress up to version 4.1.23 is vulnerable to privilege escalation. The PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter and unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping to plugin-specific capabilities. This allows authenticated attackers with user ID 1, even subscribers, to pass every WordPress capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, leading to full site takeover and remote code execution. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to and including 2.8.1 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_shedule_objective' schedule_slot parameter in all versions up to and including 4.1.23 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

In SourceCodester Online Faculty Clearance System 1.0, a SQL injection vulnerability exists in an unknown function of the file /delete_faculty1.php, through manipulation of the ID argument. The attack can be executed remotely, and the exploit has been disclosed publicly.

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the CGI Service component. Manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.

A weakness has been identified in stamparm maltrail up to 3.0.1 in the _blacklist function of core/httpd.py in the Blacklist Endpoint component. Manipulation can lead to missing authentication. The attack can be launched remotely and a public exploit is available. The issue is fixed in version 3.1.

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the DDNS Configuration component. Manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been released to the public and may be used for attacks.

The Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain sensitive information from the affected application.