CVE Vulnerability Catalog

In dnsmasq, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format after internal buffer sizes were reduced. An attacker able to force validation of a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

In dnsmasq, when following a CNAME in a DNS response, the resolver can cache records for the CNAME target without verifying they belong to the responding server's authorized zone. In split-DNS deployments sending some domains to a specific upstream, an attacker controlling that upstream can inject cache entries for unrelated names.

The TCP DNS service in dnsmasq uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation requiring TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

The TFTP server in dnsmasq can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network able to request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

The Post Grid plugin for WordPress by Mamunur Rashid contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 7.9.7.

The Video Gallery Block plugin for WordPress by bPlugins contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 1.6.0.

The Kali Forms plugin for WordPress contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 2.4.27.

The Kali Forms plugin for WordPress contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions through 2.4.27.

The Simple Cloudflare Turnstile plugin for WordPress (up to version 1.44.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The JetEngine plugin by Crocoblock (up to version 3.9.0.1) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Cozy Blocks plugin by CozyThemes (up to version 2.2.27) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The WP Job Portal plugin by Ahmad (up to version 2.7.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Ad Inserter plugin by Igor Funa (up to version 2.8.18) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Site Reviews plugin by Gemini Labs (up to version 8.3.5) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

A stored cross-site scripting vulnerability in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

A stored cross-site scripting vulnerability in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

A server-side request forgery vulnerability in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

YMS-VPN8 and YMS-VPN8-CP by Yamaha register Windows services with unquoted file paths. A user with write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

The MW WP Form plugin for WordPress up to and including 5.1.7 is vulnerable to Sensitive Information Exposure via the 'post_id' parameter. Unauthenticated attackers can extract personally identifiable information from other users' form inquiry records, including names, email addresses and message bodies, by enumerating sequential post IDs.