CVE Vulnerability Catalog

An SSRF vulnerability in GeoNode allows authenticated users with document upload permissions to send arbitrary HTTP requests by providing a malicious URL in the doc_url parameter. Attackers can target internal network resources, loopback addresses, RFC1918 addresses, or cloud metadata services.

A vulnerability in the HTTP client allows CR/LF bytes to be injected into proxy tunnel headers or host, potentially leading to HTTP response splitting or cache poisoning attacks.

W podatności CVE-2021-47960 w kliencie Synology SSL VPN przed wersją 1.4.5-0684, zewnętrzni napastnicy mogą uzyskać dostęp do plików w katalogu instalacyjnym poprzez lokalny serwer HTTP związany z interfejsem loopback. Wykorzystując interakcję użytkownika z przygotowaną stroną internetową, napastnicy mogą uzyskać wrażliwe pliki, takie jak pliki konfiguracyjne, certyfikaty i logi.

W Notepad++ w wersji 8.9.3 występuje podatność na przepełnienie bufora stosu w komponencie obsługi przeciągania i upuszczania plików. Problem występuje, gdy użytkownik przeciąga i upuszcza ścieżkę katalogu o dokładnie 259 znakach bez końcowego ukośnika, co prowadzi do przepełnienia bufora i awarii aplikacji.

The installer certificate files in the …/bootstrap/common/ssl folder on Windows systems do not have restricted permissions, allowing users to read and execute. In particular, the client.key file could lead to exploits as it exposes agent identity material to any locally authenticated standard user.

A vulnerability in the wolfSSL library causes URI nameConstraints from constrained intermediate CAs to be parsed but not enforced during certificate chain verification. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

Dockyard before version 1.1.0 lacks CSRF protection for Docker container start and stop operations. An attacker can force a logged-in administrator's browser to send GET requests, allowing unauthorized container management.

In Junos OS on MX Series with MPC10, MPC11, LC4800, LC9600 line cards and MX304, firewall filters applied to loopback interface lo0.n (where n is non-zero) are not executed when lo0.n is in the global VRF/default routing-instance. This allows an unauthenticated network-based attacker to bypass the configured firewall filter and access the device's control-plane.

A vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high-privileged attacker to escalate privileges to root. The CLI accepts input without proper validation, enabling shell command injection executed with root permissions.

A Cross-site Scripting (XSS) vulnerability was found in Juniper Networks Junos Space in the list filter field. It allows an attacker to inject malicious script tags that, when visited by another user (including an administrator), execute commands with the target's permissions. All versions before 24.1R5 Patch V3 are affected.

A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

In awwaiid mcp-server-taskwarrior up to version 1.0.1, there is a command injection vulnerability in the server.setRequestHandler function of index.ts via the Identifier argument. Local access is required. An exploit is publicly available, and a patch exists.

The Download Manager plugin for WordPress up to version 3.3.52 is vulnerable to Stored XSS via the 'sid' attribute of the 'wpdm_members' shortcode. Insufficient input sanitization and output escaping allow attackers with contributor-level access to inject arbitrary scripts.

The OSM – OpenStreetMap plugin for WordPress up to version 6.1.15 is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attributes of the [osm_map_v3] shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when a user visits the page.

The Ziggeo plugin for WordPress up to version 3.1.1 lacks authorization in the wp_ajax_ziggeo_ajax handler. It only verifies a nonce, not user capabilities. The nonce is exposed to all logged-in users. Authenticated attackers (Subscriber+) can perform many admin operations like saving translations, managing event templates, modifying SDK settings, and managing notifications.

The Experto Dashboard for WooCommerce plugin for WordPress up to version 1.0.4 is vulnerable to Stored Cross-Site Scripting in settings fields (e.g., Navigation Font Size). Insufficient input sanitization and output escaping allow authenticated attackers with Administrator access to inject scripts that execute on the settings page. This only affects multi-site installations and installations where unfiltered_html is disabled.

The MStore API plugin for WordPress up to version 4.18.3 has an IDOR vulnerability in the update_user_profile() function. An authenticated user with Subscriber access can modify arbitrary meta fields on their account, including sensitive ones like wp_user_level, without proper validation.

In taskflow-ai up to version 2.1.8, an OS command injection vulnerability was found in the terminal_execute component via manipulation in src/mcp/server/handlers.ts. The attack is remotely exploitable. Version 2.1.9 fixes the issue.

code-projects Simple IT Discussion Forum 1.0 has a cross-site scripting vulnerability in /edit-category.php via the Category argument. The attack can be launched remotely. The exploit has been published and may be used.