CVE Vulnerability Catalog

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting. The users/forgot password-reset endpoint accepted an attacker-controlled email value without first imposing a reasonable length bound or validating its format, causing the supplied value to be persisted more than once per request. The fix adds a maximum email input length of 1024 bytes, email-format validation, a per-source pre-authentication request budget, HTTP 429 responses, a 15-minute cooldown, and POST-only handling with CSRF protection.

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been published and may be used.

A vulnerability was detected in light0011 cms (specific commits). This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. Manipulation of the argument DB_DEBUG results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. This product uses rolling releases, so version details are not available.

A security vulnerability has been detected in light0011 cms (specific commits). This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product uses rolling releases, so no version details are available.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could exploit this, leading to protection mechanism bypass.

Improper Certificate Validation vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Path Traversal vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). An unauthenticated attacker with remote access could exploit this, leading to remote code execution.

Relative Path Traversal vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). A low privileged attacker with remote access could exploit this, leading to remote code execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Path Traversal vulnerability. An unauthenticated attacker with remote access could exploit this, leading to remote execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Authentication vulnerability. A low privileged attacker with remote access could exploit this, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit it, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could exploit it, leading to information disclosure.

A flaw in 389 Directory Server in the SELFDN ACI bind-rule evaluator. An anonymous LDAP client's empty bind DN is incorrectly matched against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended for authenticated identities. This can allow anonymous clients to perform operations like adding or modifying entries that should be restricted to specific authenticated users.

Privilege escalation vulnerability in the WP Fusion (Pro) plugin for WordPress, in all versions up to and including 3.47.13. Due to insufficient authorization checks on the role parameter in the thrivecart() function of the ThriveCart Auto Login handler. Authenticated attackers with Subscriber-level access and above, who possess the access_key, can create a new administrator account and gain full control over the WordPress site. The access_key is intentionally shared with ThriveCart customers as part of the setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.

The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

The Masteriyo LMS plugin for WordPress up to version 2.2.0 is vulnerable to unauthorized data deletion due to a missing capability check in the 'delete_item_permissions_check' function in CourseProgressItemsController. This allows unauthenticated attackers to delete arbitrary course progress records belonging to any student.

MISP versions up to 2.5.45 allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belongs to. The lack of parent-object ACL allows access to information outside the user's normal scope.

In MISP versions up to and including 2.5.45, several dashboard widgets displaying organisation information did not honor the Security.hide_organisation_index_from_users setting. Authenticated users without the perm_sharing_group permission could enumerate organisations that were normally hidden, and could also obtain additional database fields through JSON export. Additionally, a contributor leaderboard widget revealed all organisations with events, ignoring the same visibility setting.

MISP versions up to 2.5.45 insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The previous logic considered a URL safe if it appeared relative or hostname matched, but failed to reject dangerous schemes like javascript: or backslash-based URLs, leading to stored XSS.