CVE Vulnerability Catalog

Wtyczka Colibri Page Builder dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'post_id' w wersjach do 1.0.227 włącznie, z powodu niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL. Umożliwia to uwierzytelnionym atakującym z uprawnieniami administratora dodawanie dodatkowych zapytań SQL do już istniejących zapytań.

The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade to any earlier version of Fabric OS.

Version 3.3.7 of Archive contains a vulnerability that allows attackers to perform a path traversal attack by extracting a crafted zip file.

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

Version 2.1.2 of the Zip Swift library contains a vulnerability that allows a path traversal attack via a crafted zip entry.

RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's 'format' functionality allows someone controlling the format string to 'read' all objects accessible through recursive attribute lookup and subscription from objects he can access, which can lead to critical information disclosure.

In Splunk IT Service Intelligence (ITSI) versions below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject ANSI escape codes into log files, which can lead to the execution of malicious code in a vulnerable terminal application. The attack requires user interaction and the use of a terminal application that translates ANSI escape codes.

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. This allows the attacker to insert code into the Splunk platform installation directory.

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code located on a separate disk.

In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) references an insecure path for the OPENSSLDIR build definition. An attacker can exploit this reference to install malicious code, leading to privilege escalation on the Windows machine.

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that allows for the serialization of untrusted data. This enables the attacker to execute arbitrary code.

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.

The bbPress Toolkit plugin versions up to 1.0.12 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The Miled WordPress Social Login plugin versions up to 3.0.4 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The Dynamic QR Code Generator plugin by Rakib Hasan in versions <= 0.0.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The weDevs WP ERP plugin versions up to 1.12.3 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

phpjabbers Business Directory Script version 3.2 is vulnerable to SQL Injection via the column parameter.

The Woocommerce Order address Print plugin in versions up to 3.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The KAPlugins Google Fonts plugin for WordPress versions <= 3.0.0 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.