CVE Vulnerability Catalog

A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWanTcpipSetup function of /goform/formWanTcpipSetup. Manipulation of the pppUserName argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.

The WooCommerce PayPal Payments plugin for WordPress up to version 4.0.1 allows unauthenticated attackers to manipulate orders and leak information due to missing authorization on AJAX endpoints ppc-create-order and ppc-get-order. Attackers can create PayPal orders for any WC order and read other users' PayPal order details.

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'WishListMember3_Hooks::generate_api_key' function in all versions up to and including 3.30.1. Authenticated attackers with Subscriber-level access or above can update the REST API Secret Key, which can be used to create a new membership level with the administrator WordPress role and register an arbitrary administrator-level user account, resulting in complete site takeover.

The Wishlist Member plugin for WordPress up to version 3.30.1 lacks proper capability checks in the 'WishListMember\Features\Team_Accounts::save_settings' function. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin options, including the REST API Secret Key.

The WishList Member plugin for WordPress up to version 3.30.1 is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation. The export_settings function lacks capability checks and returns the REST API Secret Key. An attacker can use it to authenticate to the API, create a new membership level with administrator role, and register an admin account, resulting in complete site takeover.

The WishList Member plugin for WordPress up to version 3.30.1 has a privilege escalation vulnerability due to missing authorization in the ajax_get_screen() function. An authenticated attacker with Subscriber-level access can supply an admin screen identifier, causing the plugin to load the API configuration template and return the REST API Secret Key in the AJAX response.

Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.

Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.

NukeViet CMS versions 4.5.07 and prior contain a Stored XSS vulnerability due to insufficient server-side input sanitization in the Request class. An attacker can inject malicious payloads stored server-side and executed in any user's browser, exploitable by anonymous visitors without authentication.

RT is a ticket tracking system where versions up to 5.0.9 and 6.0.0-6.0.2 contain an authentication bypass vulnerability in LDAP/AD setups. An attacker can authenticate as any LDAP-backed user without valid credentials.

RT, an open-source issue and ticket tracking system, versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2, contains an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database.

RT versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can induce a logged-in RT user to visit a malicious web page, triggering arbitrary state-changing actions in RT on that user's behalf.

In libheif before 1.22.0, a crafted HEIF file with more samples declared than actually exist causes an out-of-bounds read in the SampleAuxInfoReader constructor. The vulnerability is triggered during file parsing.

An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting confidentiality, integrity, and availability.

The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. No sandboxing allows remote code execution on the Docker host as the Docker Desktop user.

The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers and runs without sandboxing. This causes arbitrary Python file execution from the model, enabling remote code execution on the Docker host as the Docker Desktop user.

MantisBT versions 2.11.0 through 2.28.1 contain a stored XSS vulnerability due to incorrect escaping of a saved filter's owner. An attacker can inject arbitrary HTML if the option to show real user names is enabled.

Vulnerability in Mantis Bug Tracker (MantisBT) versions 2.28.1 and below. An attacker can bypass Content Security Policy script-src directive by uploading a crafted attachment that, when accessed via file_download.php, is interpreted as JavaScript, enabling script execution.