CVE Vulnerability Catalog

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService. This could allow an attacker to load an unauthorized driver.

The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.

Wavlink WL-WN592AX6 version 250422 is vulnerable to a null pointer dereference in the main function of /cgi-bin/upload.cgi, triggered by manipulation of the Cookie argument. The attack can be performed remotely.

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

Polaris Office App version 9.9.19 on Android has a path traversal vulnerability in the function com.infraware.service.m.n.a of the Document Intake component, triggered by manipulation of the _display_name argument. The attack requires local access.

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

The Weaver Xtreme Theme Support plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 7.0.1.

The IMPress for IDX Broker plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 3.3.1.

The FV Simpler SEO plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 1.9.7.

The Responsive Slider plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 0.1.9.

A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continuous delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.

A vulnerability was detected in Online Cake Ordering System 1.0. An unknown function in /addtransacdetail.php is susceptible to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A weakness was identified in TensorLayer up to 2.2.4. The function load_hdf5_graph in tensorlayer/files/utils.py is affected; manipulating the model_config argument leads to deserialization. The attack can be executed remotely, and the exploit has been made public.

A vulnerability was discovered in TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The function _load_text_config in tinyllava/model/configuration_tinyllava.py is affected; manipulating the llm_model_name_or_path argument results in code injection. Remote exploitation is possible, and the exploit has been released publicly.

GitLab EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.

GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.