CVE Vulnerability Catalog

Apache Thrift before version 0.23.0 improperly validates TLS certificates, allowing host mismatch. An attacker can exploit this for man-in-the-middle attacks.

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions, the server may incorrectly process fragmented data chunks, leading to the registration of a truncated badge ID string.

The Forminator Forms plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.52.1, allowing unauthenticated attackers to read the contents of arbitrary files on the server.

A vulnerability was found in 54yyyu code-mcp in the git_operation function of the src/code_mcp/server.py file of the MCP Tool component. Manipulating the operation argument results in command injection, allowing for remote attacks.

A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8, concerning the function is_safe_path of the file src/code_mcp/server.py of the MCP File Handler component. Such manipulation leads to path traversal, allowing for remote attacks.

A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2 in the functions create_notebook, read_notebook, edit_cell, and add_cell of the file server.py. This vulnerability allows for path traversal, potentially leading to unauthorized access.

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to and including 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler.

The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to and including 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

Vulnerability in the Oracle MCP Server Helper Tool allows unauthenticated attackers with network access via HTTP to compromise the tool. Successful exploitation can lead to the execution of malicious SQL in the Oracle MCP Server Helper Tool.

The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to and including 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows unauthenticated attackers to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.

An issue was discovered in Nix before version 2.34.7 and Lix before version 2.95.2 related to unbounded recursion in the NAR parser, which could lead to a stack-to-heap overflow. If the parser is run on a coroutine stack, it may allow arbitrary code execution as the Nix daemon running with root privileges.

A security flaw has been identified in Axle-Bucamp MCP-Docusaurus that allows path traversal attacks by manipulating the DOCS_DIR/path argument in the update_document/continue_document/delete_document/get_content functions in the app/routes/document.py file.

A security flaw in A-G-U-P-T-A wireshark-mcp allows for os command injection through the quick_capture function in the pyshark_mcp.py file. The attack can be launched remotely.

A vulnerability has been found in RTGS2017 NagaAgent up to version 5.1.0, affecting unknown processing of the file apiserver/routes/extensions.py in the Skills Endpoint component. Manipulation of the argument Name leads to path traversal.

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before version 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations, bypassing file system permission protections.

Boundary Community Edition and Boundary Enterprise workers are vulnerable to a denial-of-service attack during TLS handshake for node enrollment. An attacker with network access may delay or withhold the client certificate, causing worker connection handling to block.

In version 2.3.5 of the Nginx user interface (nginx-ui), there is an unauthenticated bootstrap takeover vulnerability during the initial installation exposed by POST /api/install.

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.

W bibliotece @fastify/accepts-serializer występuje problem z nieograniczonym buforowaniem wyników wyboru serializatora, co może prowadzić do wyczerpania pamięci w Node.js. Zdalny, nieautoryzowany klient może wysłać wiele różnych nagłówków Accept, co spowoduje niekontrolowany wzrost pamięci podręcznej.

In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.