CVE Vulnerability Catalog

Improper privilege management in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user account.

Postiz, an open-source social media scheduling tool, has a path traversal vulnerability in the route serving locally stored media. The route requires no authentication and does not normalize paths, allowing an unauthenticated attacker to read any file readable by the process, including environment variables with JWT secrets and database credentials.

Weaver (Fanwei) E-cology 9.0 before 10.52 has a file upload vulnerability allowing remote unauthenticated attackers to upload arbitrary files, including JSP webshells, via a POST request to /workrelate/plan/util/uploaderOperate.jsp, leading to remote code execution.

Joomla extension SEBLOD versions < 3.30.0, < 4.7.0, < 6.0.1 have an unauthenticated path traversal vulnerability allowing file download from inside and outside the webroot.

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.

Heap type confusion vulnerability in Apache Fory C++ deserialization. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.

The Webbox application by Tobit Laboratories AG TeamDavid exposes a functionality that allows the server to be shut down when accessing the /internalRestart endpoint. This endpoint is accessible to unauthenticated users over the public internet. Instead of restarting, the server shuts down completely, enabling a remote attacker to cause persistent denial of service without authentication.

The Webbox application by Tobit Laboratories AG TeamDavid has an API endpoint vulnerable to a buffer overflow. By submitting a specially crafted JSON body, an unauthenticated attacker can crash the server, resulting in denial of service. Depending on stack state, this could potentially lead to remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has an endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. By submitting excessively long values, an authenticated attacker can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has file upload functionalities vulnerable to a buffer overflow. Specifying an excessively long filename can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has a memory leak vulnerability to an unauthorized actor. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory. Repeated requests can expose sensitive information, including user passwords. Exploitation does not require authentication.

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

The WP Events Manager WordPress plugin before version 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing unauthenticated attackers to change the password of arbitrary user accounts, including administrators.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to account takeover via improper password reset validation. The plugin does not properly validate a user's identity before resetting their password, allowing unauthenticated attackers to reset passwords of arbitrary user accounts, including administrators.

Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.