CVE Vulnerability Catalog

A flaw was found in the authentication session management of Keycloak. When an administrator enforces a stronger authentication flow, such as mandatory 2FA setup, a user can bypass this requirement by manually visiting a specific session restart web link during login. This clears internal markers tracking required security steps, allowing login with only a password.

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. In the authorization token endpoint, when processing permission tickets, if two different users own resources with the same name, the system incorrectly merges permissions from both resources. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. It affects unknown code in JobInfoController.java of the Task Management Interface. Manipulation of the argument name/author leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.

A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693 in the sub_180004AC0 function of shdrv_x64.sys (IRP_MJ_DEVICE_CONTROL Handler). Manipulation of the PID argument leads to denial of service. The attack must be carried out locally.

A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

A vulnerability was determined in code-projects Assessment Management 1.0 affecting an unknown functionality of the file lecturer/add-single-mark.php. Manipulation of the mark argument causes cross site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/add-user.php. Manipulation of the level argument results in cross site scripting, and the attack may be launched remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Assessment Management 1.0 affecting an unknown function of the file admin/edit-user.php (User Editing component). Manipulation of the name/sname/email/username/password/id arguments leads to cross site scripting, and the attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in SxDevOps versions 1.0/1.1 in the update function of backend/rbac/serializers.py, within the UserSerializer component. Input manipulation can lead to improper privilege management, and the attack can be executed remotely. The vendor was notified and quickly released a fixed version (patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9).

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorized before acting on a sign-in code supplied in the URL. Any visitor can make the site redeem a code of their choosing against the advertising platform using the site's own credentials. The code matching is loose, so URLs that merely resemble the expected one also trigger it, and the callback runs on every request to the site rather than only on the administrator's sign-in.

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data. This allows authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the plugin's own capability-gated read path reserves to administrators.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database. This field is not properly protected from access by unprivileged applications.

Exim before 4.100.1 contains a use-after-free vulnerability that occurs when certain non-default TLS settings are used with GnuTLS.