CVE Vulnerability Catalog

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

The Import and export users and customers plugin for WordPress up to version 2.4.17 is vulnerable to privilege escalation due to a mismatch in escape character handling during CSV export and import. An attacker with Subscriber-level access can exploit this to gain administrator privileges, provided an administrator triggers the export/re-import workflow with user and role updates enabled.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts.

A path traversal vulnerability was found in the OpenShift console at the /locales/resource.json endpoint, exploiting the lng and ns query parameters. An unauthenticated attacker can read sensitive .json files from the pod filesystem, including plugin manifests and configuration files, and can also target registered dynamic-plugin backends.

The EthPress – Web3 Login plugin for WordPress up to version 2.3.5 is vulnerable to authentication bypass due to a missing return statement in the verify_login() function when signature verification fails. An unauthenticated attacker can log in as any WordPress user with a linked wallet address, including administrators, enabling full site takeover.

A vulnerability was found in Neethuharii CafeManagement in the addcashier function of AddCashierCode.php, allowing manipulation of the uname/pass/role/status arguments, leading to improper authorization. The attack can be performed remotely, and the exploit has been published.

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This affects all Brocade SANnav versions before 3.0.1a.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly escapes connector property values during OSH script generation. A remote authenticated attacker could exploit this to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize special elements used in OS commands. A remote authenticated attacker could exploit this to execute arbitrary commands.

A flaw was found in openshift/console where CatalogdHandler lacks proper authentication and forwards the openshift-session-token cookie. An unauthenticated remote attacker can send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and gaining a relay into the openshift-catalogd namespace.

IBM Concert 1.0.0 through 3.0.0 invokes OS commands without fully qualifying executable paths or adequately restricting search path resolution. An attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.

IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 does not validate the Origin header on WebSocket upgrade in the Web-MQTT and Web-STOMP handlers. With ssl_cert_login=true, the browser automatically presents the client certificate, so attacker JavaScript in the victim's browser can authenticate as the victim.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 — when no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, leading the broker to accept arbitrary JWTs.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 enables permessage-deflate WebSocket compression (RFC 7692) without a max_frame_size limit and without an output-size limit on decompression. An unauthenticated attacker can send a highly compressed WebSocket frame (a zlib bomb) that inflates to gigabytes in memory, crashing a RabbitMQ node running the Web-MQTT plugin.

A flaw was found in librsvg where processing an SVG document with nested XML inclusions (Xincludes) and duplicate entity declarations can cause a use-after-free. The library incorrectly frees an XML entity still in use by the parser. An attacker could exploit this to cause a denial of service or execute arbitrary code.