CVE Vulnerability Catalog

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as type, key_data, and fingerprint, but did not fetch or authorize the associated parent event first. The fix adds parent_id and parent_type to the lookup and enforces authorization through the associated event using fetchSimpleEvent($user, parent_id). If the parent is not an Event, access is limited to site administrators.

A weakness has been identified in light0011 cms in the file App/Home/Model/UserModel.class.php of the Cookie Helper component. Manipulation of the Username argument leads to improper authentication. The attack can be performed remotely, and the exploit is publicly available.

A security flaw has been discovered in light0011 cms in the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Manipulation results in unrestricted upload. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was determined in 92181 markdown up to version 058cab0cb7fb245a0ccc6b8446963ff8d573558f. The function lds in file md.c is affected. Manipulation can lead to out-of-bounds read. The attack can be executed remotely. A patch is available as c000d2f9cf390c315378d3717cf20911cf3e80a6.

A vulnerability was found in code-projects Hospital Information System 1.0, affecting the file /HIS/his.sql of the SQL Database Backup File Handler component. Manipulation results in information disclosure. Remote exploitation is possible, and the exploit has been made public.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. A low-privileged operator with SSH access to the SCG host can gain root-level access without a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service within the orchestrator container can access the same socket and escape the container to obtain host-level control.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

A vulnerability in Bahçelievler Municipality BiHayat App allows authentication bypass due to improper restriction of excessive authentication attempts. This issue affects BiHayat App from version 2.1.7 before 2.3.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. The attacker can execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.

Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an OS Command Injection vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

The Otter Blocks plugin for WordPress, in all versions up to and including 3.1.7, is vulnerable to Insecure Direct Object Reference in the 'watch_checkout' function due to missing validation on a user controlled key. This allows unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.

The Flamingo plugin for WordPress, in all versions up to and including 2.6.2, is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with contributor-level access and above to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).