CVE Vulnerability Catalog

The W4 Post List plugin by Shazzad Hossain Khan in versions up to 3.0.6 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows Blind SQL Injection attacks.

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content.

Klever-Go prior to 1.7.20 exposes a default-open GET /subscribe endpoint that accepts unauthenticated WebSocket clients with permissive origin handling, no message size limit, and no live-connection cap. A single client can grow subscription maps, and many clients can retain goroutines, buffered channels, and descriptors, leading to memory or scheduler exhaustion.

Klever-Go prior to 1.7.20 exposes a default-open GET /log WebSocket route that does not require authentication. The first client message is parsed as a logger Profile and applied process-wide, allowing a remote client to change global log levels and formatting options and receive live process logs.

In Ansible Automation Platform automation controller, the external logging (rsyslog) configuration is generated by interpolating user-controlled settings into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component.

In automation-controller, the sanitize_jinja() function uses regular expressions that stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (e.g., an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields, a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment.

In Ansible Automation Platform automation-controller, the custom Credential Type environment-variable injector validates variable names against a deny-list that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it.

In Red Hat Ansible Automation Platform's automation-controller, the setting that formats the log message for API 4XX errors is an administrator-controlled Python format-string template rendered with a live user object as an argument. An administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password, and the formatted message is written to a logger that can be forwarded to an external log aggregator.

In Red Hat Ansible Automation Platform's automation-controller, the HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme-filtered or escaped, so a low-privileged user can embed a javascript: link rendered into a text/html response with no Content-Security-Policy.

Klever-Go prior to 1.7.20 in indexer/common.go places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, which can break the JSON string, reject a bulk batch, or inject additional bulk actions.

Klever-Go prior to 1.7.20 in core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key is selected into a consensus group, MultiSigner.Reset and the signature verification creation path cannot deserialize the group key and cancel the slot.

In Klever-Go prior to version 1.7.20, the marketplace Buy function does not check IsClaimed before accepting a bid. A seller can settle a resting-bid auction via the Claim seller-accept branch, leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered.

In Klever-Go prior to version 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature.

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

In RabbitMQ prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name or routing key beginning with amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser reads a 4-byte Count from the wire and loops Count times consuming B bytes each; with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame.

In RabbitMQ prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "*" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = "*"), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API.

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.