CVE Vulnerability Catalog

Wtyczka Fleet w Kibanie zawiera podatność, która pozwala na wykonywanie operacji z niepotrzebnymi uprawnieniami. Może to prowadzić do odczytu danych indeksów, które wykraczają poza bezpośredni zakres RBAC Elasticsearch, poprzez nadużycie uprawnień.

In Kibana, an Incorrect Authorization vulnerability (CWE-863) can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.

OpenAirInterface w wersji 2.2.0 akceptuje komunikat Security Mode Complete bez jakiejkolwiek ochrony integralności. Jeśli urządzenie końcowe (UE) wyśle początkowe żądanie rejestracji z jedynie zdolnością zabezpieczeń IA0, OpenAirInterface zaakceptuje to i kontynuuje proces.

W wersji 2.2.0 OpenAirInterface występuje podatność typu Buffer Overflow w przetwarzaniu UplinkNASTransport, która zawiera odpowiedź uwierzytelniającą z nadmiernie dużym PDU NAS (np. 100 bajtów). Odpowiedź jest dekodowana przez AMF i przekazywana do komponentu AUSF, który ulega awarii przy odbiorze tej nadmiernej odpowiedzi.

Hono prior to 4.12.12 contains a path traversal issue in toSSG() that allows files to be written outside the configured output directory during static site generation.

CI4MS before version 0.31.4.0 has a vulnerability in the Install::index() controller that reads the 'host' POST parameter without validation and passes it to updateEnvSettings(), which writes it into the .env file via preg_replace(). Since newline characters are not stripped, an attacker can inject arbitrary configuration directives into the .env file. Install routes have CSRF protection disabled, and the InstallFilter can be bypassed when cache('settings') is empty.

CI4MS before version 0.31.4.0 has a vulnerability in the install route guard that relies solely on a volatile cache check (cache('settings')) and .env file existence. When the database is temporarily unreachable (e.g., after TTL expiry or cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials.

In Eclipse Jetty, the JASPIAuthenticator class sets ThreadLocal variables during authentication but fails to clear them on early return. A subsequent request on the same thread inherits these values, leading to broken access control and privilege escalation.

In CoolerControl/coolercontrol-ui versions before 4.0.0, there is a Stored XSS vulnerability in the log viewer. Unauthenticated attackers can take over the service via malicious JavaScript in poisoned log entries.

Dell Elastic Cloud Storage (up to 3.8.1.7) and Dell ObjectScale (before 4.1.0.3 and 4.2.0.0) have a vulnerability that inserts sensitive information into log files. A low-privileged attacker with local access can exploit this to gain access with the compromised account's privileges.

In CoolerControl/coolercontrold before version 4.0.0, a command injection vulnerability in alerts allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names.

The WCAPF – WooCommerce Ajax Product Filter plugin up to version 4.2.3 is vulnerable to time-based SQL injection via the 'post-author' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive database information.

The Advanced Members for ACF plugin for WordPress up to version 1.2.5 inclusive contains an arbitrary file deletion vulnerability due to insufficient file path validation in the create_crop function. An authenticated attacker with Subscriber-level access or higher can delete arbitrary files on the server, which can lead to remote code execution after deleting a critical file such as wp-config.php.

The OrganicFood WordPress plugin (versions up to 3.6.4) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.

The Homeo WordPress plugin (versions up to 1.2.59) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.

The Freeio WordPress plugin (versions up to 1.3.21) has a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements.

The Emphires WordPress plugin contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statements. Attackers can exploit this to read arbitrary files on the server.

Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery. This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

The Biolife WordPress theme contains a PHP Local File Inclusion (LFI) vulnerability due to improper filename control in include/require statements. Attackers can read arbitrary files on the server.

A CSRF vulnerability in the SpicePress WordPress theme (spicepress) up to version 2.3.2.5. It allows an attacker to upload a web shell to the web server by exploiting an administrator's session.