CVE Vulnerability Catalog

PingIDM (formerly ForgeRock Identity Management) has insufficient granularity of access control for Remote Connector Servers (RCS) in client mode. Attackers can spoof a client-mode RCS to intercept or modify identity security properties such as passwords and account recovery information.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.33 fails to check proper capabilities in multiple AJAX controller actions. Missing checkForCap() and validatePermission() calls allow authenticated attackers with Contributor-level access and above to enumerate slider metadata and create, modify, and delete image storage records.

The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.

The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

The official Java SDK for Model Context Protocol (MCP) contains a DNS rebinding vulnerability. Prior to version 1.0.0, an attacker can access a local or network-private MCP server via a victim's browser, allowing arbitrary tool calls on the server.

Aardvark-dns versions 1.16.0 to 1.17.0 have a vulnerability where a truncated TCP DNS query followed by a connection reset causes an infinite error loop at 100% CPU usage.

Electron before versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 contains a vulnerability where a child window can be navigated by an unrelated renderer if both use the same target name. This can lead to privilege escalation, and if nodeIntegration is enabled or sandbox disabled, to remote code execution.

LibreChat prior to version 0.8.4 trusts the 'name' field returned by the execute_code sandbox when persisting code-generated artifacts. An attacker can use traversal sequences (e.g., '../../') in the filename, leading to arbitrary file write on the server without validation.

Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.

Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.

xdg-dbus-proxy before version 0.1.7 has a policy parser vulnerability that allows bypassing eavesdrop restrictions. The proxy mishandles cases like 'eavesdrop ='true'' (with a space before the equals sign), enabling clients to intercept D-Bus messages they should not have access to.

Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.

Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.

XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.

The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.

The ProofreadPage extension for MediaWiki is vulnerable to Cross-Site Scripting (XSS) targeting non-script elements. The issue is fixed in the master branch and in MediaWiki versions 1.43, 1.44, and 1.45.

The Cargo extension for MediaWiki is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags.

Cosign, a tool for signing containers and binaries, erroneously reports 'Verified OK' for attestations with malformed payloads or mismatched predicate types. The flaw exists in versions before 3.0.6 and 2.6.3.

Parse Server is vulnerable to disclosure of protected session fields via the GET /sessions/me endpoint. This endpoint returns _Session fields that the server operator configured as protected, while other endpoints correctly strip them.

Stored XSS vulnerability in Open Source Point of Sale before version 3.4.3. Insufficient input sanitization in the stock_location parameter allows injection of malicious JavaScript that executes in the Employees interface.