CVE Vulnerability Catalog

A vulnerability was found in WARP-Clash-API where the authorized function lacks authentication. Manipulation of the SECRET_KEY argument allows unauthorized remote access. The exploit has been publicly disclosed and may be used.

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.

A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.

A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Feng Office up to 3.11.13.11 affecting the update_system_module_order/update_dimension_order functions in application/controllers/MoreController.class.php (Reorder Handlers component). Manipulation of the modules/dims arguments results in SQL injection. The attack may be initiated remotely and the exploit has been made public.

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment. An attacker who knows the account password can bypass the second factor and obtain the user's session, up to administrator.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request. This allows unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media. It relies only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button. This allows members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it. Any authenticated user such as a subscriber can be granted the WordPress role attached to a paid plan without paying for it.

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account. Authenticated users with Author-level access and above can assign themselves an arbitrary role and escalate their privileges to Administrator.

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions. This allows unauthenticated users to read the submitted entries of any form created with a supported third-party form plugin.

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue affecting identity integrity but not allowing account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. A remote attacker hosting a single valid ActivityPub actor and keypair can submit signature-valid activities attributed to any actor identity.

A vulnerability of the HTTP request smuggling type was discovered in HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. It requires an HTTP/3 frontend (built with QUIC support and a QUIC bind listener) and a backend reached over HTTP/1.1 using chunked transfer coding on a reused connection. When an HTTP/3 request carries no Content-Length header, the declared length from a DATA frame header is credited before the payload is received and emitted verbatim as the HTTP/1.1 chunk size, desynchronizing the connection.