CVE Vulnerability Catalog

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the 'usces_export' action in all versions up to and including 2.11.24. This allows unauthenticated attackers to access configured payment credentials (e.g., PayPal API secret), business contact details, mail templates, and other operational settings.

The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to and including 5.1.9.4. This allows unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.

Wtyczka Import any XML, CSV or Excel File to WordPress (WP All Import) jest podatna na zdalne wykonanie kodu we wszystkich wersjach do i włącznie z 3.9.6. Problem wynika z użycia funkcji eval() na niesanitowanych danych wejściowych dostarczonych przez użytkownika w funkcji pmxi_if w pliku helpers/functions.php.

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates.

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.5 via the pagelayer_replace_page function due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access and above to replace media files belonging to other users, including administrators.

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Wtyczka LifterLMS dla WordPressa jest podatna na eskalację uprawnień. Problem wynika z braku odpowiedniej weryfikacji tożsamości użytkownika przed umożliwieniem mu modyfikacji własnej roli za pośrednictwem REST API.

Anubis, a Web AI Firewall Utility, prior to version 1.23.0 did not validate the redirect URL when using subrequest authentication, allowing redirection to any URL scheme. While most modern browsers block redirects to `javascript:` URLs, it could still trigger dangerous behavior in some cases. The issue is fixed in version 1.23.0.

Bitplatform Boilerplate, a Visual Studio and .NET project template, versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in WebInteropApp/WebAppInterop, potentially allowing attackers to inject malicious scripts that compromise the security and integrity of web applications. Version 9.11.3 fixes the issue.

Zidentyfikowano podatność na obejście uwierzytelniania w niektórych routerach serii DSL, która może umożliwić zdalnym atakującym uzyskanie nieautoryzowanego dostępu do dotkniętego systemu.

File Browser w wersjach przed 2.45.1 ma podatność typu Insecure Direct Object Reference (IDOR) w funkcji usuwania udostępnionych linków. Umożliwia to każdemu uwierzytelnionemu użytkownikowi z uprawnieniami do udostępniania usunięcie linków innych użytkowników bez odpowiednich kontroli autoryzacji.

In the Linux kernel's netfilter, validation of objref and objrefmap expressions is missing. Referencing a synproxy object from the OUTPUT hook causes infinite recursion and a kernel crash.

In the Linux kernel's Btrfs filesystem, the btrfs_encode_fh() function can write data out of bounds. This occurs when the file handle size is larger than originally reported.

W jądrze Linuxa naprawiono podatność związaną z porównywaniem MAC w czasie stałym. W celu zapobiegania atakom czasowym, MAC powinny być porównywane w sposób zapewniający stały czas wykonania.

In the Linux kernel, the listmount() function calls path_put() under the namespace semaphore, which can lead to a deadlock or crash if it is the last reference.

In the Linux kernel's IPMI driver, there is a problem with the user message limit, leading to incorrect counting and use-after-free. Code restructuring fixes these issues.

In the Linux kernel's sys_prlimit64(), there is a race condition when using task_lock(tsk->group_leader). A process can exit or exec, leading to use-after-free or taking the wrong lock.

In the Linux kernel's page_pool, the PP_MAGIC_MASK is too wide on some 32-bit architectures, causing false positives in page_pool_page_is_pp() and system crash.

In the Linux kernel's ext4 filesystem, the parse_apply_sb_mount_options() function may read beyond the buffer (buffer over-read). The s_mount_opts field in the superblock may not be NULL-terminated.

A bug in the Linux kernel quota mechanism causes a kernel panic when panic_on_warn is enabled. The issue occurs when the 'events_unbound' workqueue (without WQ_MEM_RECLAIM flag) is used for quota_release_work and then flushed by the 'writeback' workqueue with WQ_MEM_RECLAIM flag, triggering a WARN_ONCE due to dependency mismatch.