CVE Vulnerability Catalog

The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The JW Player for WordPress plugin versions 2.3.11 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. The DOM code is not affected. Users are recommended to upgrade to versions 4.0.2, 3.0.6, or 2.4.4 which fix this issue.

The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.

The WPFunnels plugin versions 3.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

MISP contains a stored cross-site scripting (XSS) vulnerability in the event graph preview feature. The event graph preview image field is accepted and stored without server-side validation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Ultimate Maps by Supsystic plugin versions 1.5.5 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Easy Google Maps plugin versions 1.14.6 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms versions up to 3.15.3. An attacker can inject malicious script without authentication.

The If-So Dynamic Content Personalization WordPress plugin through 1.10.1 is vulnerable to Reflected XSS due to improper neutralization of input during web page generation.

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages.

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availability.

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user with tag editor permission could craft a request that includes additional model data (such as User or Organisation records), enabling modification or creation of privileged accounts and escalation to site administrator.

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD. The SFTP client implementation did not check that a received reply corresponded to a previously sent request, causing unsolicited replies to be stored but never consumed. A malicious server could send such replies until client memory is exhausted.

Apache MINA SSHD allows partial authentication bypass. When the SSH server is configured to require two different public keys, the server code in component sshd-core does not enforce that the presented keys are different. A user can successfully authenticate by presenting the same key twice.

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this to cause incorrect data processing or a denial-of-service condition.