CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX versions up to 3.8.8. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension versions up to 3.3.26.

Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 versions up to 1.0.

Unauthenticated Cross Site Scripting (XSS) in Under Construction versions up to 5.82.

Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.

The Product Variations Swatches for WooCommerce plugin versions up to 1.1.18 contain a Subscriber Cross Site Scripting (XSS) vulnerability. A low-privileged user can inject malicious scripts that execute in other users' browsers.

The Graphene plugin versions up to 2.9.4 contain a Subscriber Cross Site Scripting (XSS) vulnerability. A low-privileged user can inject malicious scripts that execute in other users' browsers.

OpenList before version 4.2.3 contains a vulnerability in the offline download feature that allows an unprivileged user to write files outside the temporary directory, potentially creating, truncating, or overwriting any file writable by the OpenList process. The vulnerability stems from a lack of containment check in the filename derived from the Content-Disposition header.

A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.

MISP contains a session fixation vulnerability in the CustomAuth authentication flow. After successful authentication via CustomAuth, MISP stores the authenticated user identity in the existing session without first rotating the session identifier. An attacker who knows the victim's session identifier before authentication can later reuse it to access the victim's authenticated session.

A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection, enabling repeated guessing of OTP and potential bypass of the additional authentication factor.

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. An attacker could cause an authenticated user with sufficient privileges to invoke the endpoint, leading to deletion of published empty events.

A vulnerability was detected in SeaCMS up to 13.6. The function addslashes in the file weixin/index.php of the WeChat Module is affected. Manipulation of the argument Content results in SQL injection, which can be launched remotely.

A security vulnerability has been detected in SeaCMS up to 13.6. The function parseIf in the file seacms_locoy_news.php of the Locoy Collector component is affected. Manipulation of the argument pwd leads to code injection, and the attack can be initiated remotely.

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before placing it into a command line for an integrated terminal. An unauthenticated remote user who persuades a developer to accept a connection and open the shell feature can inject arbitrary characters into that command line.

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name, the library may read memory outside the intended buffer and terminate the calling process.

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On 32-bit builds, an unauthenticated party able to supply a sufficiently large JSON input to an application may cause it to terminate unexpectedly, resulting in denial of service.

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be triggered by specially crafted certificate data during the handshake, causing the same heap object to be released twice and leading to unexpected termination of the client application.

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened or the corresponding field to be omitted, while the parsing operation still reports success and returns no error.

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.