CVE Vulnerability Catalog

HCL MyXalytics is affected by a potential DoS vulnerability. It allows users to input data without any restriction on the number of characters, which can impact system performance or availability.

HCL MyXalytics is affected by a Content Spoofing vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.

HCL MyXalytics is affected by an improper input validation vulnerability. It allows malicious or unexpected data to cause unintended system behavior or security issues.

OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects.

OpenVPN versions 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries.

Vulnerability in mwiede jsch up to version 2.28.5. The getRevokedKeys function in KnownHosts.java is vulnerable to improper check for certificate revocation via the known_hosts argument. The attack can be performed remotely but has high complexity and is difficult to exploit. Upgrading to version 2.28.6 is recommended.

A vulnerability has been identified in valkey-io valkey up to 9.0.5/9.1.1, involving an out-of-bounds read in the kvstoreGetHashtable function of src/kvstore.c via manipulation of the didx argument. The attack can be initiated remotely but requires cluster mode and attacker-controlled dump.rdb at startup, making exploitation difficult. The exploit has been made public, and a patch is available.

A cross-site scripting (XSS) vulnerability has been discovered in Projectworlds Online Attendance System 1.0, in the profile.php file via manipulation of the email argument. The attack can be performed remotely, and the exploit has been released publicly.

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.

A vulnerability has been found in code-projects Task Management System 1.0, specifically in the user profile update component, in the file /user/UpdateUserProfile.php. Manipulation of the lname argument results in cross-site scripting. The attack can be launched remotely, and the exploit has been made public.

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.

The EmbedPress WordPress plugin before version 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.

The EmbedPress WordPress plugin before version 4.6.4 does not properly restrict access to one of its Google Reviews REST routes, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.

The Events Calendar WordPress plugin before version 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

The Kirki WordPress plugin before version 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.

The My Private Site WordPress plugin before version 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.

The Smart Post WordPress plugin before version 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.

The Joli Table Of Contents WordPress plugin before version 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page. This could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.

The JCH Optimize WordPress plugin before version 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site. This allows high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

In libxml2 before 2.15.4, xmlregexp in xmlRegNewParserCtxt has a NULL pointer dereference after a strdup failure, i.e., it does not calculate a string length after NULL checking.