CVE Vulnerability Catalog

Flaw in php-file-manager-with-code-editor up to 3.0. Manipulating the files argument in move_uploaded_file in filemanager.php leads to unrestricted upload. Attack can be executed remotely.

Flaw in libstdc++. Integer overflow when processing large inputs to aligned operator new may lead to undersized memory allocation, potentially causing memory corruption or application instability.

A vulnerability was found in changedetection.io up to 0.60.7 in the check_authentication function of changedetectionio/flask_app.py within the Authentication Hook component. Improper validation leads to improper authentication, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass in the REST API. The flaw allows unauthorized access to protected API functionality.

ZenHive mpp (from 0.14.0 before 0.16.2) has improper validation of specified quantity in input. A client with an open payment channel can obtain paid resources without being charged because a voucher with the same cumulative amount is treated as an idempotent success and maybe_spend/2 is not called. The same signed voucher can be re-presented under new challenges, yielding an unbounded number of paid units.

ZenHive mpp (from 0.14.0 before 0.16.2) is vulnerable to authentication bypass by capture-replay. An attacker holding a captured subscription activation credential can repeatedly charge the payer because the signed authorization is not tied to the challenge and activation deduplication is keyed by challenge id. Each replay triggers a new first-period settlement and re-authorizes the server key.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses, exposing user data and allowing CSRF protection bypass and token theft.

Privilege escalation due to weak configuration while temporary file handling.

Privilege escalation due to weak configuration during package extraction process.

Exposed dangerous function lead to privilege escalation via gRPC server.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server.

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

The Taxi Booking Manager for WooCommerce plugin by Magepeople inc. contains an Authentication Bypass vulnerability using an alternate path or channel. This issue affects versions before 2.0.8.

The ssh library in Erlang/OTP contains an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exhaust node memory by repeatedly opening session channels that are never assigned a handler. This affects OTP from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6).

A denial-of-service vulnerability in the Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder is caused by inefficient algorithmic complexity (quadratic) when processing very large subidentifiers. A remote unauthenticated attacker can send a crafted OID during the TLS handshake, causing prolonged CPU consumption (e.g., about 13 seconds for ~262 KB of data). The issue affects the BER, PER, and JER decoders in lib/asn1.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files.

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, making it possible for authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.