CVE Vulnerability Catalog

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or removing members and enabling public access to a private board.

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file. Unauthenticated attackers who can determine its identifier can download customer names, purchases, amounts and guest email addresses.

The Eventin WordPress plugin before 4.1.24 does not properly authorize order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order. This allows unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker. This allows users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.

The Schema & Structured Data for WP & AMP plugin before 1.66 fails to check user permissions to edit a specific post when generating schema, allowing users with contributor role and above to read other users' draft, pending, private and password-protected posts.

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process and leveraged social engineering could obtain cross-origin data via a crafted HTML page.

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Race condition in Network in Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.

Vulnerability in Oracle VM VirtualBox (component: Core) affecting version 7.2.16. An easily exploitable flaw allows a high-privileged attacker with local logon to cause a partial denial of service of Oracle VM VirtualBox, with possible impact on additional products (scope change).

Vulnerability in Oracle VM VirtualBox (component: Core) affecting version 7.2.16. An easily exploitable flaw allows a high-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle VM VirtualBox accessible data, with possible impact on additional products (scope change).

Vulnerability in Oracle Coherence (component: Core) affecting version 15.1.1.0.0. A difficult-to-exploit flaw allows a low-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle Coherence accessible data.

Vulnerability in Oracle Coherence (component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A difficult-to-exploit flaw allows a high-privileged attacker with local logon to gain unauthorized update, insert, or delete access to some Oracle Coherence accessible data.

Vulnerability in Oracle Access Manager (component: Access SDK) affects versions 12.2.1.4.0 and 14.1.2.1.0. It is difficult to exploit but allows a low-privileged attacker with network access via HTTP to cause a partial denial of service (partial DoS) of the service.

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. An authenticated user with sitemap access could change the display order of pages they had no rights to edit. The reorder action also lacked CSRF token validation.

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user with access to the bulk SEO tool and view (but not edit) permission could change the page's meta title, meta description, and URL handle, tampering with presentation and live URLs of protected content.

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page. An authenticated user with sitemap access but no edit or arrange rights could still move the page and alter the site's global navigation order.

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session or in the browser of any visitor to a page using an Express Entry List block.