CVE Vulnerability Catalog

Authorization Bypass Through User-Controlled Key vulnerability in WP Rentals by sc Internet Vivoo allows exploiting incorrectly configured access control security levels. Affects versions before 3.16.0.

In Checkmk versions before 2.5.0p10, improper certificate validation allows a relay and a push agent sharing the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

Apache SkyWalking Booster UI (part of Apache SkyWalking UI) versions 10.2.0 through 10.4.0 are vulnerable to cross-site scripting (XSS) due to improper neutralization of input during web page generation. The product is marked as UNSUPPORTED WHEN ASSIGNED.

A use-after-free vulnerability was found in libsoup's HTTP/2 client implementation. A malicious HTTP/2 server or MITM attacker can exploit it when a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, information disclosure, or arbitrary code execution.

Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.

Pik Online Portal through version 3.5.1 uses a one-way hash without salt, which enables cryptanalysis attacks. The vulnerability affects Pik Online Software Solutions Inc. Pik Online Portal.

Canva Android App before version 2.376.0 did not restrict headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user's session.

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before version 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

Apache Allura through version 1.20.0 has a vulnerability that exposes non-public information via search. The issue is fixed in version 1.21.0.

The Ninja Forms WordPress plugin before version 3.15.2 does not restrict its REST abilities to administrators, treating a plugin-specific capability as equivalent to full site administration. This allows any user granted that capability to read settings and stored submissions, overwrite configuration, and create or modify arbitrary posts and pages.

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue affects versions through 1.20.0 and is fixed in version 1.21.0.

Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.

The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

The WPFunnels WordPress plugin before version 3.13.0 does not restrict access to log files it writes to a predictable location under the public uploads directory. This allows unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.