CVE Vulnerability Catalog

The SureForms plugin (up to version 2.12.9) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data requiring higher privileges.

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.

Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.

Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.

Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.

Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.

Missing Authorization in the WP Desk Custom Price for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Custom Price for WooCommerce through version 1.1.29.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the WP Chill Strong Testimonials plugin allows Stored XSS. This issue affects Strong Testimonials through version 3.3.15.

Missing Authorization in the Magepeople inc. Taxi Booking Manager for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Taxi Booking Manager for WooCommerce through version 2.1.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allow unauthorized attackers to arbitrarily read another user's private notes, tasks, and diary content.

A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.

In dnsmasq, the DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

The Codection Import and export users and customers plugin contains a Stored Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. The issue affects versions from the initial release through 2.5.9.

The Brave Popup Builder WordPress plugin (Brave) through version 0.8.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The PDF Poster WordPress plugin (pdf-poster) through version 2.6.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious script can be persistently stored and executed for users.

The HivePress Claim Listings plugin through version 1.1.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The Kali Forms plugin through version 2.4.27 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.