CVE Vulnerability Catalog

Oberon PSA Crypto library versions 1.0.0 through before 1.5.1 are vulnerable to a padding oracle attack. An attacker can recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.

Oberon microsystem AG's ocrypto library versions 3.1.0 through before 3.9.2 are vulnerable to a padding oracle attack. An attacker can recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. An attacker could create an account, save its JWT, delete the account (which did not invalidate the JWT), and then reuse the same identifier assigned to a new user to authenticate as that user. The issue was fixed in version 3.44.0.

Payload uses JSON Web Tokens (JWT) for authentication. After logout the JWT is not invalidated, allowing an attacker who has stolen or intercepted the token to reuse it until expiration (default 2 hours, but configurable). The issue is fixed in version 3.44.0.

The Events Addon for Elementor plugin for WordPress is vulnerable to stored cross-site scripting via its Typewriter and Countdown widgets in all versions up to and including 2.2.9 due to insufficient input sanitization and output escaping.

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator privileges to read or write limited files in SRM and conduct limited denial-of-service via unspecified vectors.

Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature.

The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to and including 1.2 due to insufficient escaping and lack of preparation on the SQL query. Authenticated attackers with Contributor-level access and above can append additional SQL queries to extract sensitive information from the database.

The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to import tags, provided they can trick a site administrator into performing an action such as clicking a link.

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to stored cross-site scripting via the Map Block URL in all versions up to and including 1.3.0 due to insufficient input sanitization and output escaping.

The List Subpages plugin for WordPress is vulnerable to stored cross-site scripting via the 'title' parameter in all versions up to and including 1.0.6 due to insufficient input sanitization and output escaping.

The LWSCache plugin for WordPress has improper authorization in the lwscache_activatePlugin() function, allowing unauthorized data modification in versions up to and including 2.8.5. An authenticated attacker with Subscriber-level access or higher can activate arbitrary whitelisted LWS plugins.

A flaw was discovered in E4 Sistemas Mercatus ERP 2.00.019 in the file /basico/webservice/imprimir-danfe/id/, involving improper control of resource identifiers. Manipulation of the parameter may lead to unauthorized access to resources, and the attack can be launched remotely. The vendor was contacted but did not respond.

A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability was found in Portabilis i-Educar up to 2.10 in the file /module/FormulaMedia/view (Formula de Cálculo de Média Page). Manipulating the ID argument leads to SQL injection. The exploit has been publicly disclosed and remote exploitation is possible.

A flaw was found in Portabilis i-Educar up to 2.10 in the file /module/TabelaArredondamento/view (Tabelas de Arredondamento Page). Manipulating the ID argument can lead to SQL injection, and the attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda_preferencias.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.

An Unquoted Service Path vulnerability exists in some HikCentral FocSign versions. It could allow an authenticated user to potentially enable privilege escalation via local access.

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.

A vulnerability was found in Telesquare TLR-2005KSH version 1.2.4 in an unknown function of /cgi-bin/internet.cgi?Command=lanCfg. Manipulating the Hostname argument leads to command injection. The attack can be performed remotely and the exploit has been publicly disclosed.