CVE Vulnerability Catalog

Information disclosure in BVMS 4.5 up to 12.3 allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints, the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance, leading to unauthorized read access to events of other organizations, and if the delegation is accepted, transfer of event ownership.

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures, which can be trivially bypassed.

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.

A vulnerability in the Go implementation of Apache PLC4X (PLC4Go) involves improper verification of the source of a communication channel during ADS discovery. An attacker can send a spoofed UDP datagram to the discovering host, redirecting subsequent connections to an arbitrary address. The connection address is derived from the AmsNetId in the response body rather than the datagram's actual source. Additionally, a single malformed datagram can disable discovery listeners in both PLC4Go and PLC4J implementations, causing panics, exceptions, or infinite loops.

The Go implementation of Apache PLC4X (PLC4Go) contains multiple severe defects, including integer overflow, improper validation of array indices, uncontrolled recursion, and memory allocation with excessive size values. A malicious device or an attacker able to inject network traffic can crash or exhaust the memory of the client application, causing a denial of service.

A vulnerability in Apache PLC4X (Java implementation, PLC4J) allows a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the OPC UA driver, these defects are reachable before authentication, during secure channel and session establishment, before the server's identity is bound. Affects versions 0.10.0 through 0.13.1.

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user. This allows any authenticated user, such as a subscriber, to install and activate any theme hosted on the WordPress.org repository.