CVE Vulnerability Catalog

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.

Insufficient data authenticity verification in Meona Client Launcher and Meona Server components allows sending messages to any email address.

Cleartext storage of sensitive information in memory vulnerability in Meona Client Launcher and Meona Server components. Affects Client Launcher through 19.06.2020 15:11:49 and Server through 2025.04 5+323020.

The Slider Revolution plugin for WordPress up to version 7.0.9 has a sensitive information exposure vulnerability via the 'get_stream_data()' function. Unauthenticated attackers can extract data including password-protected post, page, and product content.

NLnet Labs Unbound from version 1.14.0 up to 1.25.0 has a locking inconsistency vulnerability that under certain conditions (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) can lead to heap use-after-free and crash. An attacker can exploit if conditions are met. Unbound 1.25.1 contains a fix.

NLnet Labs Unbound up to version 1.25.0 has a vulnerability when handling replies with very large RRsets that require name compression. Malicious upstream responses with very large RRsets whose records do not share a suffix above the root can cause Unbound to spend considerable time applying name compression, leading to degraded performance and potential denial of service. The compression limit introduced in 1.21.1 did not account for records without a common suffix above the root, bypassing the compression counter. The fix in 1.25.1 increments the compression counter regardless of the compression tree lookup.

NLnet Labs Unbound up to version 1.25.0 has a vulnerability in the DNSSEC validator where the negative cache code path for DS records does not respect the NSEC3 hash calculation limit introduced in 1.19.1.

NLnet Labs Unbound versions up to 1.25.0 contain a vulnerability in the jostle logic that can degrade resolution performance. Duplicate queries can refresh the timestamp, preventing the jostle logic from replacing old queries with new ones. An attacker controlling a slow DNS server can exploit this to degrade Unbound's performance.

Dell SmartFabric Storage Software versions prior to 1.4.5 contain a command injection vulnerability. A high-privileged authenticated attacker with local access can exploit this to gain filesystem access.

NLnet Labs Unbound from version 1.6.2 to 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support. A malformed DNSCrypt query can underflow the packet reading procedure, potentially leading to heap overflow.

The WordPress plugin Anomify AI – Anomaly Detection and Alerting up to version 0.3.6 is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS). Missing nonce verification in the settings page handler and insufficient output escaping in the admin_options.php template allow unauthenticated attackers to inject malicious scripts by tricking an administrator.

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.

The NextGEN Gallery plugin for WordPress up to version 4.2.0 has an Insecure Direct Object Reference vulnerability in the image deletion REST API. Object-level authorization is missing – only 'NextGEN Manage gallery' permissions are checked, without gallery ownership verification. An authenticated attacker with Subscriber privileges and 'NextGEN Manage gallery' capability can delete other users' images and associated files from disk.

The Email Encoder WordPress plugin before version 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks.

Missing authorization in Movable Type allows a user without admin privileges to perform unintended updates after signing in.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.14 contains a stored XSS vulnerability via the X-Forwarded-For header. An unauthenticated attacker can inject arbitrary JavaScript that executes whenever a user accesses the injected page. Note: practical exploitation is limited to 20 characters.

A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.

The All in One SEO plugin for WordPress up to version 4.9.7 exposes sensitive internal option data via 'internalOptions' localized script data passed to wp_localize_script() in post editor contexts. Lack of effective masking for low-privilege users allows authenticated attackers with Contributor-level access or higher to view configured API/OAuth tokens and license-related values from the page source.

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. Successful exploitation might lead to denial of service (DoS).

NVIDIA Triton Inference Server contains a path traversal vulnerability. An attacker can exploit this flaw, leading to denial of service (DoS).