CVE Vulnerability Catalog

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) allows an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system.

In Wapt Server before version 2.6.1.17813, a remote unauthenticated attacker can bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account.

In Wavlink WL-NU516U1 (version 708c073-mt7628), the change_password function in nas.cgi has a stack-based buffer overflow via the User1Passwd argument. The attack can be executed remotely, and the exploit is publicly available.

In Wavlink WL-NU516U1 (version 708c073-mt7628), the fgets function in nas.cgi has a stack-based buffer overflow via the CONTENT_LENGTH argument. Remote exploitation is possible.

The 'Import and export users and customers' WordPress plugin before version 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

The 'Link Library' WordPress plugin before version 7.9.3 does not properly sanitize and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The 'ChamaWP' WordPress plugin before version 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

The 'Personal QR Message' WordPress plugin through version 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

The 'Insert or Embed Articulate Content into WordPress' plugin through version 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.

The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

The SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow. This allows unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.

The Super Store Finder WordPress plugin before 7.11 fails to sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract database data.

The Webinfos WordPress plugin through version 1.2 does not validate the type or name of uploaded files, nor does it require authentication or a nonce check for the upload action. This allows unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

PyAthena prior to 3.35.4 contains a SQL injection vulnerability in DefaultParameterFormatter.format(). Unauthenticated attackers can inject arbitrary SQL by exploiting improper quote-escaping.

FreeRDP before 3.30.0 has a heap-based buffer overflow in CliprdrStream_Read. A malicious RDP server can send an oversized response, causing an out-of-bounds write.

The POUCO Import Users WordPress plugin through version 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value. This allows unauthenticated attackers to create a new administrator account and take over the site.

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. The Apple login handler accepts the Apple id_token and decodes only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to invoke the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page.