CVE Vulnerability Catalog

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s).

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. An authenticated attacker with access to the log file including the SANnav supportsave can access the passwords.

The Database Addon For WPForms (wpforms entries) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads can overflow stack buffers, causing a crash of the weblinker daemon.

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges.

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine, and malformed account names can cause the execution of embedded shell metacharacters.

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames, the receiving switch processes them at an elevated level without proper verification. An attacker on a single fabric-connected switch can escalate privileges and execute arbitrary root commands locally or across other managed fabric members.

In Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1, handling of specific download protocols uses unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed via a shell. Because control characters and shell metacharacters are not stripped, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure can prevent the web management service from starting or recovering, leading to a persistent Denial of Service (DoS).

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. updateSmartList sets creatorId to the caller identity and can set visibility to PRIVATE, locking out the original owner.

An Improper Input Validation vulnerability in Brocade ASCG before v3.0 affects registered case credentials. A local authenticated user can provide invalid inputs like special characters, leading to a Denial of Service (DoS) when collecting 'supportsave' from a Brocade Switch.