CVE Vulnerability Catalog

A vulnerability was found in Feng Office up to 3.11.13.11 affecting the update_system_module_order/update_dimension_order functions in application/controllers/MoreController.class.php (Reorder Handlers component). Manipulation of the modules/dims arguments results in SQL injection. The attack may be initiated remotely and the exploit has been made public.

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment. An attacker who knows the account password can bypass the second factor and obtain the user's session, up to administrator.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request. This allows unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media. It relies only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button. This allows members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it. Any authenticated user such as a subscriber can be granted the WordPress role attached to a paid plan without paying for it.

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account. Authenticated users with Author-level access and above can assign themselves an arbitrary role and escalate their privileges to Administrator.

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions. This allows unauthenticated users to read the submitted entries of any form created with a supported third-party form plugin.

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue affecting identity integrity but not allowing account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. A remote attacker hosting a single valid ActivityPub actor and keypair can submit signature-valid activities attributed to any actor identity.

A vulnerability of the HTTP request smuggling type was discovered in HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. It requires an HTTP/3 frontend (built with QUIC support and a QUIC bind listener) and a backend reached over HTTP/1.1 using chunked transfer coding on a reused connection. When an HTTP/3 request carries no Content-Length header, the declared length from a DATA frame header is credited before the payload is received and emitted verbatim as the HTTP/1.1 chunk size, desynchronizing the connection.

A SQL injection vulnerability was found in Feng Office up to 3.11.13.11, affecting the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php within the Legacy API component. Manipulation of the auth argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A flaw was found in restify (node-restify) up to 12.0.0, affecting the serveStatic function in /lib/plugins/static.js. The manipulation causes path traversal. The attack can be initiated remotely and the vendor did not respond to the disclosure.

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The kernel driver idmwfp.sys exposes the \\.\IDMWFP device interface to authenticated local users with an access control descriptor equivalent to D:P(A;;GA;;;AU), and its IOCTL 0x12C028 handler does not authenticate the caller or restrict operations to IDM-owned registry namespaces. This allows a low-privileged local authenticated user to read, create, modify, and delete arbitrary registry values under HKLM and HKU.

In UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7, the webserver does not limit the number of HTTP request headers. A remote attacker can send a request with an unlimited number of headers, causing memory consumption and an unresponsive server, if a websocket or JSON-RPC listener is enabled (disabled by default).

A vulnerability has been detected in webgjc web_robot versions 2.4.0, 2.5.0 and 2.8.0. The controller_listen/controller_recover functions in py/web.py mishandle the case_name argument, leading to OS command injection. The attack can be performed remotely and a public exploit is already available.

A weakness has been identified in sanjevirau gsubs up to version 1.0.3. The showQuerySuccessPage function in renderer/index.js of the Electron component mishandles the filename argument, allowing code injection. The attack can be performed remotely and the exploit is publicly available.

A security flaw has been discovered in lenve vhr version 1.0-SNAPSHOT. Unknown processing in the MailReceiver component leads to deserialization of untrusted data. The attack can be carried out remotely and the exploit has been publicly disclosed.

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client accepts any certificate without chain validation. An attacker positioned to intercept traffic can present a crafted certificate and modify responses, including substituting malicious package content or altering allow/block decisions.