CVE Vulnerability Catalog

Vulnerability in SurrealDB before 3.1.5 in the DEFINE ANALYZER mapper filter allows arbitrary file read. Users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying paths in the filter and retrieving content via error messages when SURREAL_FILE_ALLOWLIST is empty or unconfigured.

Vulnerability in SurrealDB before version 3.2.0 allows authenticated users to access custom API endpoints in other namespaces/databases, potentially leading to reading sensitive data or unauthorized operations.

In _connect.BRAIN prior to version 5.06, the LogPathConfig.exe application is executed during setup, deleting existing permissions on %ProgramData% and replacing them with full control for the Everyone group, instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with version 5.06, the setup no longer runs this tool.

In BRAIN2 prior to version 3.09, the LogPathConfig.exe application is executed during setup, granting the Everyone group full control over %ProgramData% instead of restricting access to %ProgramData%\Bizerba\BRAIN2\. Starting with version 3.09, the setup no longer runs this tool, but the optional Bizerba ScriptService still executes it. ScriptService is deprecated and will not be included from version 3.11.

Authenticated OS command injection vulnerability in the system_certificates view, exploitable by a high-privileged remote attacker. Improper neutralization of special elements leads to total loss of confidentiality, availability, and integrity.

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. The generate_id function in Dancer2::Core::Role::SessionFactory uses low-entropy sources such as rand(), making session ids easy to guess.

The Tag Groups WordPress plugin before version 2.2.0 improperly escapes one of its AJAX parameters before reflecting it in the response body served with an HTML content type. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.

A vulnerability in the Crypt::Password library for Perl (versions up to 0.28) allows timing attacks. The check_password method uses the eq operator, enabling attackers to guess the hash based on response time discrepancies.

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before version 1.4.1 does not enforce rate limiting or account lockout for passwordless email OTP verification, and stores short numeric codes in plaintext. An unauthenticated attacker who knows a registered email address can brute-force the code and log in as that user, including an administrator, leading to full site takeover.

The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

The SlimStat Analytics WordPress plugin before version 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator viewing the reports. Exploitation requires the plugin to be configured with the Cloudflare geolocation provider.

The Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins before version 7.34.0 do not sanitize and escape a request parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. This leads to an unauthenticated SQL injection vulnerability allowing attackers to extract sensitive data from the database.

The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.

In Meshtastic prior to version 2.7.23.b246bcd, a single node advertising a User.long_name with malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The issue arises from accidental null terminator placement in a multibyte sequence during buffer truncation, poisoning the node database.

Keras version 3.15.0 has an unsafe deserialization vulnerability of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method calls `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in. Outside a `SafeModeScope(True)` context, unsafe deserialization is allowed by default, potentially leading to arbitrary code execution.

In the Linux kernel, a potential out-of-bounds access was found in the AMD IOMMU debugfs interface. The iommu_mmio_write() and iommu_capability_write() functions used kstrtou32_from_user() for input parsing, which could convert large values into negative integers, leading to out-of-bounds memory reads/writes.

A vulnerability in the Linux kernel's __vm_normal_page() function mishandles missing support for pmd_special()/pud_special() on 32-bit x86 systems with THP enabled. This triggers warnings, RSS counter bugs, and page state corruption during memory reclaim.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth BNEP module. The bnep_add_connection() function failed to hold the bnep_session_sem lock while reading dev->name, allowing a concurrent bnep_session() thread to free the net_device.

In iwlwifi driver for old devices (e.g., 7265D), a bug was found in setting TX rates due to incorrect encoding in v1 format (PLCP) instead of v3, potentially causing warnings when reported back from the device.

In the iwlwifi driver for Intel BE201 Wi-Fi 7 chipsets, a vulnerability was found where transmission is not stopped during firmware restart. After a firmware crash (e.g., NMI_INTERRUPT_UNKNOWN), the driver continues sending frames that are rejected, causing high CPU load and memory fragmentation.