CVE Vulnerability Catalog

Tenda AC6 w wersji 15.03.05.16_multi jest podatna na przepełnienie bufora w funkcji formSetCfm, które występuje poprzez parametry funcname, funcpara1 i funcpara2.

A Server-Side Request Forgery (SSRF) vulnerability was found in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1. Insufficient sanitization of user-supplied HTML allows embedding elements like <iframe> that are fetched server-side. An attacker can force the server to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to sensitive information disclosure.

QD 20230821 jest podatny na atak typu Server-side request forgery (SSRF) poprzez odpowiednio skonstruowane żądanie. Atakujący może wykorzystać tę podatność do wysyłania żądań do wewnętrznych zasobów serwera.

XWiki Platform is a wiki platform. Prior to versions 17.4.8 and 17.10.1, an improperly protected scripting API allows users with script right to bypass the Velocity sandbox and execute arbitrary Python scripts, leading to full access to the XWiki instance.

Zidentyfikowano podatność w stata-mcp przed wersją 1.13.0, gdzie niewystarczająca walidacja treści plików do-file dostarczonych przez użytkownika może prowadzić do wykonania nieautoryzowanych poleceń.

A cleartext storage of sensitive information vulnerability in the GUI of Mitsubishi Electric products (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to disclose SQL Server credentials displayed in plain text in the Hyper Historian Splitter feature.

A vulnerability in Mitsubishi Electric software (GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, MC Works64) allows a local attacker to read SQL Server credentials stored in plaintext in a local SQLite file. This occurs when local caching using SQLite is enabled and SQL authentication is used.

A Cross-Site Request Forgery (CSRF) vulnerability in the Theme Editor WordPress plugin allows code injection. An attacker can trick an administrator into performing unintended actions.

A Cross-Site Request Forgery (CSRF) vulnerability in the Appointment WordPress plugin allows uploading a web shell to the server. An attacker can trick an administrator into performing unintended actions.

A Cross-Site Request Forgery (CSRF) vulnerability in the Busiprof WordPress plugin allows uploading a web shell to the server. An attacker can trick an administrator into performing unintended actions.

A Cross-Site Request Forgery (CSRF) vulnerability in the Bluestreet WordPress plugin allows performing unintended actions on behalf of an administrator. An attacker can trick an administrator into performing unintended actions.

Movable Type by Six Apart Ltd. contains an SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements.

Movable Type dostarczany przez Six Apart Ltd. zawiera podatność na wstrzykiwanie kodu, która może umożliwić atakującemu wykonanie dowolnego skryptu Perl.

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function. The function is exposed via a `wp_ajax_nopriv_` hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This allows unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes.

The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint is exposed to all visitors via wp_localize_script, rendering the nonce check ineffective. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field.

Wtyczka Everest Forms dla WordPressa jest podatna na wstrzyknięcie obiektów PHP we wszystkich wersjach do 3.4.3 włącznie, poprzez deserializację nieufnych danych wejściowych z metadanych wpisów formularzy. Problem wynika z wywołania funkcji PHP unserialize() na przechowywanych wartościach metadanych bez przekazania parametru allowed_classes.

W zmiennych indukcyjnych w pętlach nie sprawdzano poprawnie wystąpień niedomiaru lub przelania. W efekcie kompilator mógł zezwolić na nieprawidłowe indeksowanie w czasie wykonywania, co potencjalnie prowadziło do uszkodzenia pamięci.

IBM Verify Identity Access Container w wersjach 11.0 do 11.0.2 oraz IBM Security Verify Access Container w wersjach 10.0 do 10.0.9.1 mogą pozwolić lokalnie uwierzytelnionemu użytkownikowi na eskalację uprawnień do poziomu root z powodu wykonywania z niepotrzebnymi uprawnieniami.

Emmett, a full-stack Python web framework, versions 2.5.0 through 2.8.0 contain a path traversal vulnerability in the RSGI static handler for internal assets (/__emmett__ paths). An attacker can use ../ sequences (e.g., /__emmett__/../rsgi/handlers.py) to read arbitrary files outside the assets directory.

SiYuan prior to 3.6.4 contains a stored XSS vulnerability that allows remote code execution in the Electron desktop client. An attacker can import a crafted note into a synced workspace, and when the victim opens it, attacker-controlled JavaScript executes with access to Node.js APIs.