CVE Vulnerability Catalog

Wtyczka InfiniteWP Client dla WordPressa jest podatna na ujawnienie wrażliwych informacji w wersjach do 1.11.1 włącznie, poprzez funkcję 'admin_notice'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta lub wyżej wydobycie wrażliwych danych, w tym konfiguracji.

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'user-submitted-content' parameter in versions up to and including 20230809 due to insufficient input sanitization and output escaping.

LiteSpeed OpenLiteSpeed before version 1.7.18 does not strictly validate HTTP request headers.

In the checkDebuggingDisallowed method of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed.

SVG Loader is a JavaScript library that fetches SVG files and injects their code into the document. The input sanitization logic is insufficient, allowing an attacker to craft a malicious SVG that leads to Cross-site Scripting (XSS) attacks.

A stack overflow vulnerability was discovered in the Tenda A18 version V15.13.07.09, occurring via the wpapsk_crypto2_4g parameter in the fromSetWirelessRepeat function.

The Tenda A18 device in version V15.13.07.09 was found to contain a stack overflow vulnerability in the formWifiBasicSet function via the security parameter.

Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function.

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory.

IBM TXSeries for Multiplatforms versions 8.1, 8.2, and 9.1 is vulnerable to a denial of service due to improper enforcement of the timeout on individual read operations. A remote attacker could exploit this vulnerability by conducting slowloris-type attacks.

The Facsimile Support product for IBM i versions 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system.

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

Wtyczka AdFoxly – Ad Manager, AdSense Ads & Ads.Txt w wersjach do 1.8.5 zawiera podatność na nieautoryzowane odzwierciedlone ataki typu Cross-Site Scripting (XSS). Atakujący może wykorzystać tę lukę do wstrzyknięcia złośliwego kodu JavaScript.

A memory exhaustion vulnerability in ONLYOFFICE Document Server versions 4.0.3 through 7.3.2 allows a remote attacker to cause a denial of service via a crafted JavaScript file.

The vulnerability allows an attacker to misuse ESET’s file operations during the module update, potentially leading to the deletion or movement of files without proper permissions.

GNU inetutils before 2.5 may allow privilege escalation due to unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd.

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials. Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

Versions of async-sockets-cpp up to 0.3.1 have a stack-based buffer overflow in the ReceiveFrom and Receive functions in udpsocket.hpp when processing malformed UDP packets.

In version 2.0.8 of the libboron library, there is a heap-based buffer overflow in the ur_strInitUtf8 function in string.c.