CVE Vulnerability Catalog

In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.

A remote code execution vulnerability in the rlottie library used by Telegram, caused by lack of proper validation of user-supplied data, resulting in a write before the start of an allocated buffer. Exploitation requires user interaction — visiting a malicious page or opening a malicious file.

The WordLift plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WordLift from n/a through 3.54.15.

The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.

The AI Engine plugin by Meow Apps contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.3.

The Simply Schedule Appointments plugin by NSquared contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Simply Schedule Appointments from n/a through 1.6.12.35.

The Strong Testimonials plugin by WP Chill contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Strong Testimonials from n/a through 3.3.12.

The APIExperts Square for WooCommerce plugin by WPExperts contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects APIExperts Square for WooCommerce from n/a through 4.7.5.

The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin by PluginUs.Net contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects MDTF from n/a through 1.4.0.

XXL-JOB up to 3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user with permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

In @libp2p/webrtc prior to 6.0.28, the webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, and protocol negotiation. The packet-controlled request.ufrag is forwarded to DirectRTCPeerConnection.setLocalDescription and reused as an ICE password without validating its required length and character set, causing an uncaught native invalid_argument and process abort with SIGABRT.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality. This issue affects Booking and Rental Manager: from n/a through 2.8.0.

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

A flaw in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, used by WildFly and JBoss EAP for deployment management, allows an attacker with the Deployer RBAC role to use path traversal sequences to access files outside the deployment directory. This can lead to deletion of arbitrary directories or creation of files with arbitrary content, resulting in full privilege escalation to the SuperUser role.

A Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.

In Lychee before 7.7.1, the POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array that is merged after server-computed purchase parameters. An unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before passing to an Omnipay gateway, allowing underpayment and acquisition of goods.

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema.