CVE Vulnerability Catalog

Pomerium, as an identity and context-aware access proxy, may make incorrect authorization decisions due to specially crafted requests. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, and 0.22.2.

Zulip, a team collaboration tool, has a cross-site scripting (XSS) vulnerability in tooltips on the message feed. An attacker can craft a malicious topic for a message that, when hovered over by a victim, executes JavaScript code controlled by the attacker.

The Calendar app for Nextcloud discloses some internal paths of the website when the SMTP server is unavailable. It is recommended to update the Calendar app to version 3.5.5 or 4.2.3.

Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allows arbitrary file overwrite and possibly code execution via crafted world data that contains a symlink.

tgstation-server is a tool for managing BYOND servers that may have an issue with the DreamMaker API chat channel cache. After a restart and reattach of tgstation-server, the cache can be poisoned, leading to chat messages being sent to configured IRC or Discord channels.

The Contacts app for Nextcloud syncs contacts from various devices and allows editing. The unsanitized SVG is converted to a JavaScript blob, which the Avatar cannot render.

ToUI is a Python package for creating user interfaces that uses Flask-Caching to store user variables. Versions 2.0.1 to 2.4.0 are affected by an issue with the `Website.user_vars` property. This issue has been patched in version 2.4.1.

In Moov signedxml through 1.0.0, parsing the raw XML can result in different output than parsing the canonicalized XML. This allows for bypassing signature validation via a Signature Wrapping attack (XSW).

CVE-2023-34204 affects imapsync versions up to 2.229, which uses predictable paths in the /tmp and /var/tmp directories. These directories are typically world-writable, allowing an attacker to modify imapsync's cache and overwrite user files.

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.

The Supsystic Easy Google Maps plugin versions up to 1.11.7 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

The WooCommerce Product Vendors plugin versions <= 2.1.76 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts in the user's context.

The WooCommerce Follow-Up Emails (AutomateWoo) plugin versions up to 4.9.40 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The WooCommerce Follow-Up Emails (AutomateWoo) plugin versions <= 4.9.40 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.

The ThemeinProgress WIP Custom Login plugin versions <= 1.2.9 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

The CRM Perks Contact Form Entries plugin versions <= 1.3.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.

The WP-Matomo Integration (WP-Piwik) plugin versions up to 1.0.27 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

The Ciprian Popescu YouTube Playlist Player plugin versions up to 4.6.4 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The PluginOps MailChimp Subscribe Form plugin versions up to 4.0.9.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.

The EventPrime plugin versions up to 2.8.6 have an unauthenticated reflected XSS (Cross-Site Scripting) vulnerability. An attacker can exploit this flaw to inject malicious scripts in the user's context.