CVE Vulnerability Catalog

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

OpenPrinting CUPS before version 2.4.20 has a flaw in copy_banner() that uses the attacker-controlled attributes-natural-language value as a directory component. This allows escaping the banner directory and copying an arbitrary file into a spool object that can be delivered to the attacker.

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.

Helium before version 2.2.60 allows any authenticated user to submit an arbitrary URL to POST /feed/externalcalendars/. The server uses validate_url only to check syntax, then fetches the URL via urllib.request.urlopen, enabling forced outbound requests and internal service reconnaissance.

In OpenPrinting CUPS, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory, predict the connection-derived name, and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). Fixed in version 2.4.20.

In OpenPrinting CUPS before 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. These mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument, allowing a user permitted to submit a job to inject control characters into the downstream option stream.

In OpenPrinting CUPS before 2.4.20, the quote_string() function in backend/ipp.c preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD control line and persist an attacker-selected PPD keyword.

In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.

The bincookie library (a header-only binarycookies parser) prior to version 0.1.9 contains a heap buffer overflow in bincookie_init_file(). The function allocates a buffer based on the actual .binarycookies file length but uses the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries, allowing reads and writes beyond the heap allocation. Related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses.

Discourse ActivityPub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. These missing identity and ownership checks allow a remote attacker to edit, delete, or reply to federated posts without the required permissions.

In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.

A remote code execution vulnerability in the rlottie library used by Telegram, caused by lack of proper validation of user-supplied data, resulting in a write before the start of an allocated buffer. Exploitation requires user interaction — visiting a malicious page or opening a malicious file.

The WordLift plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WordLift from n/a through 3.54.15.

The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.

The AI Engine plugin by Meow Apps contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.3.

The Simply Schedule Appointments plugin by NSquared contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Simply Schedule Appointments from n/a through 1.6.12.35.

The Strong Testimonials plugin by WP Chill contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Strong Testimonials from n/a through 3.3.12.

The APIExperts Square for WooCommerce plugin by WPExperts contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects APIExperts Square for WooCommerce from n/a through 4.7.5.

The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin by PluginUs.Net contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects MDTF from n/a through 1.4.0.

XXL-JOB up to 3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user with permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.