CVE Vulnerability Catalog

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

The Timetics WordPress plugin through version 1.0.61 does not enforce per-object ownership when updating appointments via its REST API, allowing users with the custom staff role to modify, disable, or take over appointments belonging to other staff members.

The Icegram Express WordPress plugin before version 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

The Weaver Show Posts WordPress plugin before version 1.8.1 unserializes the content of an imported file, which could lead to PHP object injection issues when a high privilege user imports a malicious file and a suitable gadget chain is present on the blog.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions from 0.0.0 to 1.0.2.

Privilege defined with unsafe actions in Drupal Content Moderation Notifications allows privilege escalation. Affects versions from 0.0.0 to 3.9.0.

Observable timing discrepancy in Drupal Commerce CyberSource allows brute force attacks. Affects versions from 0.0.0 to 1.10.0.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

The Rank Math SEO WordPress plugin before version 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata. This allows users with the Author role and above to read the title, body, and metadata of other users' non-public posts.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata. This allows users with the Author role and above to alter that metadata on content, taxonomy terms, and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts.

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Severity: Medium)

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75. A remote attacker who compromised the renderer process could bypass web origin policy via a crafted HTML page.