CVE Vulnerability Catalog

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.

The Connect Contact Form 7 and Mailchimp plugin for WordPress up to version 0.9.78.06 is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator accesses the injected page via Contact Lookup.

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes.

The GenerateRandomPassword function in bosh-windows-stemcell-builder uses a cryptographically weak random number generator, allowing a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions are prior to v2019.98.

A vulnerability in the BOSH.Utils.psm1 script of bosh-windows-stemcell-builder allows low-privileged authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon service or system restart, an attacker can gain NT AUTHORITY\SYSTEM privileges, leading to full host control.

An argument injection vulnerability in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned SSH process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.

A vulnerability in BOSH CLI (versions prior to 7.10.4) causes the client to skip server certificate verification for DAV blobstore during create-env and delete-env operations, allowing a network attacker to intercept Basic-auth credentials and read the rendered-templates archive containing all bootstrap secrets for the new BOSH Director.

The Everest Forms WordPress plugin before version 3.5.0 does not reliably delete temporary CSV files generated during email notification processing, leaving them publicly accessible in the uploads directory. This allows unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

The Divi Form Builder plugin for WordPress up to version 5.1.8 has an authorization bypass vulnerability. The update_user() function accepts a user ID from form submissions without verifying permissions, and handle_register_submission() only checks if a user is logged in, not if they can edit the target account. This allows authenticated attackers with subscriber-level access or higher to change the email and password of any user, including administrators, leading to full account takeover.

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI prior to 7.10.5.

A SQL injection vulnerability has been found in Interview Management System 1.0 in the file \inc\classes\View.php via the ID argument. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability has been discovered in code-projects Online Food Order System 1.0 in the /edit_food_items.php file. Remote manipulation of the update argument allows SQL injection. The exploit has been publicly released.

A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.

A vulnerability in Cline Hub dashboard server before version 3.0.30 allows an attacker to send desktopCommand frames via WebSocket without Origin header validation. When ROOM_SECRET is unset for local 127.0.0.1 binds, the isAuthorizedBrowserRequest() function enables attacker-controlled websites to read workspace state, mutate MCP and provider settings, and trigger command execution.

In CoreWCF version 1.9.0, SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used. This allows an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an attacker to replay a captured signed SOAP envelope to execute arbitrary service operations as the victim. The issue stems from missing verification that the ds:Signature covers the expected Security header target.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows bypassing SubjectConfirmation method URI and holder-of-key proof key validation in SAML tokens. An attacker can exploit this to downgrade holder-of-key or use custom confirmation method assertions to authenticate without proving authority over the assertion.

A vulnerability in the CoreWCF library allows SAML signature verification to be skipped when a non-X.509 signing token is used. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an unauthenticated remote attacker to trigger premature EOF handling in the framing handshake for NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoints. This pins one server thread-pool worker at full CPU per connection.

A vulnerability in the Stanza NLP library allows arbitrary code execution via a malicious .pt model file. The model loading mechanism first attempts safe torch.load with weights_only=True, but falls back to unsafe weights_only=False on an attacker-controlled pickle.UnpicklingError, enabling arbitrary code execution when the model is loaded.