CVE Vulnerability Catalog

jsondiffpatch packages before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads are used as the diff source and the result is rendered with the built-in HTML formatter on a private website.

The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

kalcaddle kodbox 1.61 has a path traversal vulnerability in the fileGet/fileSave functions in app/controller/explorer/editor.class.php via the path argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely and the exploit has been made available to the public.

An Open Redirect vulnerability was found in Freshwork up to version 1.2.3 in the file /api/v2/logout. By manipulating the post_logout_redirect_uri argument, an attacker can redirect the user to a malicious site. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed. Upgrading to version 1.2.3 fixes the issue.

Liferay Portal 7.4.3.73 through 7.4.3.128 and Liferay DXP in specific versions are vulnerable to Reflected Cross-Site Scripting. Remote attackers can inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

In libxml2 up to and including 2.9.14, XPath evaluation functions (xmlXPathRunEval, xmlXPathCtxtCompile, xmlXPathEvalExpr) reset recursion depth to zero before recursive calls, allowing a local attacker to cause uncontrolled recursion and a stack overflow via crafted expressions.

An improper access control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0-2024.Q2.8, 2024.Q1.1-2024.Q1.12, 7.4 GA through update 92) allows guest users to obtain object entries information via the API Builder.

A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0 affecting the Search function of the file app/modules/api/service/Api.js. Manipulation of the key argument leads to SQL injection. The attack can be launched remotely and the exploit has been made available to the public. The vendor did not respond.

Papermerge DMS up to 3.5.3 contains a flaw in the Authorization Token Handler that results in improper authorization. The attack can be performed remotely and a public exploit is available. The vendor was contacted but did not respond.

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128 and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92. Remote attackers can execute arbitrary web script or HTML in the My Workflow Tasks page.

Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Exploitation requires a high privileged user with a developer role.

A buffer overflow vulnerability exists in the Tenda F3 router version V12.01.01.48_multi and later. The issue is triggered via the wifiTimeClose parameter in the goform/setWifi function.

A buffer overflow vulnerability exists in the Tenda F3 device version V12.01.01.48_multi and later, in the onlineList parameter of the goform/setParentControl function. An attacker can remotely cause a crash or potentially take control of the device.

A buffer overflow vulnerability exists in Tenda F3 router version V12.01.01.48_multi and later. The issue is triggered via the macFilterList parameter in the goform/setNAT request.

A buffer overflow vulnerability exists in the Tenda F3 router version V12.01.01.48_multi and later via the QosList parameter in the goform/setQoS function. An attacker can remotely crash the device or potentially gain control over it.

A buffer overflow vulnerability has been discovered in the Tenda F3 router version V12.01.01.48_multi and later. The issue resides in the portList parameter of the /goform/setNAT endpoint.

A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass image signature verification and load unsigned software. This is due to incomplete validation of files during .iso installation.

A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This occurs because management interface ACLs are not supported on Packet I/O infrastructure platforms for Linux-handled features.