CVE Vulnerability Catalog

The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize or escape user-supplied gallery display configuration values before storing and outputting them in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.

The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize and escape a gallery item identifier before outputting it in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions. This allows any authenticated user, including subscribers, to act on and alter orders belonging to other customers.

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options. This allows any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes. This allows users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions. This allows authenticated users with low privileges, such as subscribers, to delete the plugin's configured profile and post form fields.

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file stored in its web-accessible directory. The plugin writes the site's carrier integration key into this log while processing requests from unauthenticated users, allowing attackers to retrieve the key and modify WooCommerce order statuses. The same log file also exposes customer information from processed orders.

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints. This allows unauthenticated users to retrieve the site's scheduled background tasks and their arguments, including order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.

A vulnerability in wolfSSH up to version 1.5.0 allows an unauthenticated client to send Diffie-Hellman group exchange messages (SSH_MSG_KEX_DH_GEX_GROUP and SSH_MSG_KEX_DH_GEX_REPLY) to a server, which fails to check the direction of these messages. The server then runs a client-side handler, leading to expensive Miller-Rabin primality tests on attacker-controlled data and generating a key pair in an attacker-chosen group.

A flaw was found in GIMP's X cursor (XMC) thumbnail loader. When generating a thumbnail for a crafted XMC file, a pixel buffer is allocated using a width * height size computed in 32-bit signed arithmetic, which can overflow and lead to an out-of-bounds read on the heap.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.

A flaw was found in `sssd-kcm` that allows a local denial of service. A local user or process able to connect to the `sssd-kcm` UNIX socket can send a request with a large length header and then stall the connection, causing significant memory preallocation. This leads to memory exhaustion in the `sssd-kcm` responder, resulting in a DoS.

Requesting a user or organization profile page with an Accept header for RSS/Atom returned the owner's activity feed without the visibility check applied by the profile page and .rss/.atom routes. Anonymous, restricted users and non-members could confirm the existence of limited or private users/organizations and read their profile details and public activity, even when ENABLE_FEED was disabled. Activity in private repositories was not included.

The Gitea API endpoint for creating push mirrors checked only whether mirroring was enabled, not the [mirror] DISABLE_NEW_PUSH setting enforced by the web interface. A repository administrator could create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.