CVE Vulnerability Catalog

Bitwarden Desktop version 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.

A vulnerability was found in phpRecDB version 1.3.1 that allows cross site scripting (XSS) attacks through manipulation of the r/view argument in the /index.php file. The issue has been rated as problematic.

Wtyczka InfiniteWP Client dla WordPressa jest podatna na ujawnienie wrażliwych informacji w wersjach do 1.11.1 włącznie, poprzez funkcję 'admin_notice'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta lub wyżej wydobycie wrażliwych danych, w tym konfiguracji.

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'user-submitted-content' parameter in versions up to and including 20230809 due to insufficient input sanitization and output escaping.

A Cross-site Scripting (XSS) - Reflected vulnerability exists in the GitHub repository librenms/librenms prior to version 23.8.0.

LiteSpeed OpenLiteSpeed before version 1.7.18 does not strictly validate HTTP request headers.

In the checkDebuggingDisallowed method of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed.

PrivateUploader is an image hosting server that in affected versions did not correctly verify whether the user was an administrator or moderator. This led to processing requests even when the response indicated insufficient permissions.

SVG Loader is a JavaScript library that fetches SVG files and injects their code into the document. The input sanitization logic is insufficient, allowing an attacker to craft a malicious SVG that leads to Cross-site Scripting (XSS) attacks.

The vulnerability in efibootguard arises from insufficient validation and sanitization of input from untrusted bootloader environment files, which can lead to crashes and potential code injections. This issue occurs when attempting to modify a manipulated environment, particularly user variables.

A stack overflow vulnerability was discovered in the Tenda A18 version V15.13.07.09, occurring via the wpapsk_crypto2_4g parameter in the fromSetWirelessRepeat function.

The Tenda A18 device in version V15.13.07.09 was found to contain a stack overflow vulnerability in the formWifiBasicSet function via the security parameter.

Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function.

Svelecte is a flexible autocomplete/select component written in Svelte that renders item names as raw HTML without escaping. This allows for arbitrary HTML injection into the Svelecte dropdown, potentially executing arbitrary JavaScript when the dropdown is opened.

In ScanCode.io, the `/license/` endpoint does not properly validate and sanitize the detailed view key, which can lead to a potential cross-site scripting (XSS) vulnerability. Attackers can exploit this flaw to inject malicious scripts that will be executed in users' browsers.

The Yak Engine has a local file inclusion (LFI) vulnerability that allows attackers to include files from the server's local file system through the web application. Exploiting this vulnerability can lead to unintended exposure of sensitive data or potential remote code execution.

The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.