CVE Vulnerability Catalog

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could delete that Dag's queued asset events, silently suppressing asset-triggered scheduling.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability. A low-privileged user could gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to and including 3.8.2. Unauthenticated attackers can append additional SQL queries and extract sensitive information from the database.

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to and including 4.5.1. The injection occurs in a numeric, unquoted SQL context, and the AJAX handler is accessible without authentication and without a nonce check.

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.8.5 via the 'mockups' parameter. An unauthenticated attacker can read arbitrary files on the server, and the required nonce is easily obtainable by unauthenticated users.

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to and including 1.23.0 via the my_profile_update() function. The lack of nonce verification, capability checks, and meta key validation allows an authenticated attacker with Subscriber-level access to modify arbitrary user metadata.

The TECHIN2B Application contains an Authorization Bypass Through User-Controlled Key vulnerability that allows Privilege Abuse. The issue affects versions from V1.0.7676.13 through 18092026.

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.4. An authenticated attacker with Subscriber-level access can delete arbitrary Filter Gallery records by supplying attacker-controlled gallery IDs.

The WordPress plugin is vulnerable to DOM-Based Cross-Site Scripting due to improper neutralization of input during web page generation. This affects versions from n/a through 7.1.

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the plugin's stored gallery options.

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the settings, and in the browser of any visitor to a page displaying the booking widget.