CVE Vulnerability Catalog

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can disclose restricted page names, URL paths, and internal URLs from all sites and languages.

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file with excessive header field lengths to trigger allocation of gigabytes of memory, causing resource consumption and termination.

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

The Yordam Library Information and Document Automation Program (versions from v22.1 before v22.2) has an open redirect vulnerability to untrusted sites, which enables phishing attacks.

The Yordam Library Information and Document Automation Program (before v22.2) has a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to make requests from the server to internal resources.

The Yordam Library Reservation System (before v22.2) has a missing authentication for critical functions vulnerability, allowing input data manipulation.

Documentum Webtop versions prior to 16.7.1 are vulnerable to XSS (Cross-Site Scripting).

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. Fixed in bubblewrap 0.12.0.

Dell SCG 5.0 Appliance before 5.36.00.16 and Dell SCG 5.0 Application before 5.36.00.00 contain an insertion of sensitive information into externally-accessible file or directory vulnerability. A low privileged attacker with local access could exploit this, leading to information exposure.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Several Newfold plugins are vulnerable to Authentication Bypass due to the wp-module-data module. The authenticate() method degenerates when HiiveConnection::get_auth_token() returns false, allowing unauthenticated attackers to compute a valid token and gain administrator access. Vulnerable versions: Crazy Domains (<= 2.5.2), Web (<= 2.3.4), Hostgator (<= 3.1.0), Bluehost (<= 4.17.1).

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Authentication vulnerability. A low privileged attacker with remote access could exploit this to gain unauthorized access.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves unsynchronized access to shared data in a multithreaded context. A low-privileged attacker with remote access could exploit this, leading to denial of service.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper certificate validation. An unauthenticated attacker with remote access could exploit this, leading to protection mechanism bypass.

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper neutralization of special elements in an SQL command (SQL Injection). A low-privileged attacker with remote access could exploit this, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

A use of less trusted source vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module allows exploitation of trusted identifiers. This issue affects versions from v9.0.0 before v9.0.3.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.