CVE Vulnerability Catalog

The WS-Security (wsse:UsernameToken) verification routine in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier has an improper authentication vulnerability. A remote attacker can bypass authentication and execute privileged ONVIF actions (PTZ control, stream URL retrieval, system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

A heap-based buffer overflow in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp.

The Quiz And Survey Master plugin in versions up to and including 11.2.5 contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows access to objects that a user should not be authorized to reach.

The Site Kit by Google plugin in versions up to and including 1.186.0 is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). This allows an attacker to force a logged-in user to perform unwanted actions.

The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.

The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.

The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin in versions up to and including 2.3.21 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.

The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.

The Starter Templates plugin in versions up to and including 4.7.5 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they should not have permission to.

The RTMKit plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF). A user with the Subscriber role can be tricked into performing unwanted actions.

The Masteriyo - LMS plugin in versions up to and including 3.4.0 contains a Broken Access Control vulnerability. A user with the Subscriber role can perform actions beyond their granted permissions.

The Passster plugin in versions up to and including 4.3.13 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

The Slim SEO plugin in versions up to and including 4.10.0 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they do not have permission to.

The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.

The Bold Page Builder plugin in versions up to and including 5.9.9 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.

The Sky Addons for Elementor plugin in versions up to and including 3.8.4 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.