CVE Vulnerability Catalog

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers.

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers.

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser.

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies.

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies.

The Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability. An unauthenticated attacker can inject scripts through the unsanitized 'key' parameter in iframe.php by sending a crafted GET request.

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash.

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not validate that the server's challenge was valid base64. A malicious server could send a challenge causing Thunderbird to include uninitialized heap memory in its NTLM response, disclosing it to the server; a challenge consisting only of base64 padding caused an out-of-bounds read and crash.

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password.

In virtualenv before 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can cause a victim-owned target outside the destination to become broadly writable.

In virtualenv before 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account can cause files outside the requested tree to be created or overwritten.

In virtualenv before 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can produce files writable by another local account in a later traversable environment.

In virtualenv before 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause files outside the environment to be deleted.

In virtualenv before 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination.

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload.

In virtualenv versions 21.14.8 through 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. Enabling symlink_app_data via environment variable or configuration file can trigger this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname its owner no longer controls. This is fixed in version 21.14.10.

Cachet versions 2.4.1 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form. An authenticated attacker can inject malicious HTML/JavaScript that executes in the browser of any user viewing the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in cachethq/core patch the issue.

EspoCRM up to 9.3.10/10.0.10 has a vulnerability in the ImageSourceProvider::get function in application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php within the PDF Rendering Pipeline component. Manipulating the ID argument results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 and installing it is recommended.

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen. Malicious data stored in logs may execute as script in the browser of a user viewing that screen.

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.