CVE Vulnerability Catalog

The Smart App Banner plugin in versions up to 1.1.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The BEAR plugin in versions <= 1.1.3.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The Awesome Motive Duplicator Pro plugin versions up to 4.5.11 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

CSRF vulnerability in Crocoblock JetFormBuilder plugin versions <= 3.0.6 allows attackers to perform unauthorized actions on behalf of users.

The WooDiscuz – WooCommerce Comments plugin has a stored XSS vulnerability that can be exploited by users with admin privileges. This issue affects versions from n/a to 2.2.9.

Nextcloud Mail is a mail app in Nextcloud that is vulnerable to a blind SSRF attack. This attack allows sending GET requests to services running on the same web server.

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

The vulnerability in ntpd-rs, an NTP implementation written in Rust, is due to the lack of validation of NTS cookie lengths in received NTP packets. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects.

Omni-notes is a note-taking application for Android that had a path validation vulnerability. This vulnerability allowed malicious applications to copy files from internal storage to external storage, potentially leading to unauthorized data access.

The vulnerability in Rekor allows a malformed entry of type `intoto/v0.0.2` to cause a panic in a thread within the Rekor process. However, the service continues to run, and the client receives a 500 error message.

Craft is a content management system (CMS) for creating custom digital experiences. A cross-site scripting (XSS) vulnerability can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

Highlight is an open-source monitoring platform that may record passwords when an HTML password input is switched to `type="text"` via a JavaScript 'Show Password' button. This behavior differs from the expected one that always obfuscates `password` type inputs.

Django-SES is a mail backend for Django that implements support for AWS Simple Email Service. The django_ses library had a flaw in verifying AWS request signatures, allowing users to specify arbitrary public certificates.

An issue was discovered in Papaya Viewer version 1.0.1449 related to the lack of input sanitization. User-supplied DICOM or NIFTI images can be loaded, allowing arbitrary JavaScript code injection into image metadata, which is executed when that metadata is displayed.

The Talend Data Catalog remote harvesting server before version 8.0-20230413 contains an /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server.

Craft is a content management system (CMS) for creating custom digital experiences on the web. A cross-site scripting (XSS) vulnerability has been identified that can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.