CVE Vulnerability Catalog

Electron is a framework for writing cross-platform desktop applications. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.

Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.

Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.

Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

A flaw in the SAML broker component of Keycloak, used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only, allowing an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

A flaw in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can register an allowed mapper type with malicious configuration and then swap it for a restricted, high-privilege mapper type, gaining full administrative access to the realm.

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability in the parseXmlPayload() function within the event processing pipeline. When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 without authentication.

A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response with no single response entries. An attacker can leak a tunable amount of memory per TLS handshake, potentially leading to memory exhaustion and denial of service in long-running clients.

Penpot's ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

A flaw in the Dynamic Client Registration (DCR) component of Keycloak. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can forge administrative roles in their access token, leading to takeover of other clients, theft of confidential secrets, and potential full administrative control over the realm.

A flaw in Keycloak's Authorization Services. The PathMatcher component does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters, an attacker can trick the system into applying a less restrictive security policy, allowing an authenticated user to access administrative or restricted areas they should not have permission to see.

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every REST API endpoint being registered with `permission_callback => '__return_true'` in all versions up to and including 1.1.16. This allows unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings, including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload(), without any nonce or capability check.

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes `git status --porcelain` without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to and including 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wp_kses_post() does not strip because it retains img elements and data-* attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature embedded in public page HTML. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which incorrectly disables signature validation for SAML responses when identity provider metadata lacks specific usage attributes for keys. This allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

The Content Egg plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. Insufficient validation of the 'img_file' field allows authenticated attackers with author-level access or above to delete arbitrary files on the server.

The Zosi C519M camera version V4.2.8.823C01450BA is vulnerable to incorrect access control. The RTSP authentication mechanism contains hardcoded credentials that cannot be changed. An attacker with network access can use these default credentials to access the RTSP video stream and view camera footage without authorization.

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed with no restriction, reachable by any member with write access to comments (the default setting).