CVE Vulnerability Catalog

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

A vulnerability in the Auto block feature in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks. The issue stems from improper restriction of excessive authentication attempts.

An SQL Injection vulnerability in the EventScheduler API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.

A CRLF Injection vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

The MasterStudy LMS WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

A flaw in libmongoc's SCRAM authentication implementation causes the client to continue the handshake and transmit the client proof even when a nonce mismatch is detected in the server's first message. A man-in-the-middle attacker can inject a crafted server-first-message with a controlled salt and low iteration count, then capture the client proof for offline password cracking. The vulnerability is mitigated by TLS, which is standard in production deployments.

Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.

In Omni before versions 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, which url.URL.JoinPath normalizes into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics.

In uniget before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments.

In punchin-email before version 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass.

The AsyncHttpClient (AHC) library in versions 3.0.8 through 3.0.12 does not enforce verification of SCRAM ServerSignature and Digest rspauth authentication results. On a non-TLS or compromised transport, an attacker can be accepted as the server without proving knowledge of the shared secret. The issue is fixed in version 3.0.12.

The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.