CVE Vulnerability Catalog

A denial of service vulnerability has been addressed in Tanium Server. This flaw could allow an attacker to disrupt server operations.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The LatePoint plugin for WordPress up to version 5.4.0 has an improper input validation vulnerability in the Stripe Connect payment processor. This allows unauthenticated attackers to pay arbitrary amounts by supplying a previously successful PaymentIntent token.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL injection via the 'mc_auth' parameter in versions up to and including 3.7.8. This is due to insufficient escaping and lack of proper SQL query preparation.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.

The WCFM Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 2.11.10. The 'wcfmvm_membership_change' AJAX action fails to validate user permissions to modify other users, allowing authenticated attackers with vendor-level access or higher to change any user's role to 'wcfm_vendor' by altering their membership plan.

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before version 2.0.8 allows authenticated X clients to execute code within the X server.

A heap buffer overflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows authenticated X clients to execute code within the X server.

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

When opening a PDF with embedded JavaScript, the application performs abnormal operations on a list box field, repeated after form reset. The application fails to properly validate form objects and their internal dictionary pointers, leading to an illegal pointer read and application crash.

There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.

When opening a PDF file, during JavaScript-based deletion of pages and attachment annotations, the attachment panel accesses invalid pointers, causing the application to crash.

The vulnerability in the PDF-opening application stems from missing upper limit and consistency checks during the construction process. This leads to out-of-bounds array access, ultimately causing the application to crash.

The vulnerability in a PDF viewing application occurs when JavaScript resets form fields, causing re-entry into the interface and damaging the native object. The application fails to validate the object before calling a function, leading to a crash.

A vulnerability in a PDF viewing application causes a crash after opening a PDF file. The script resets the annotation state and triggers a form reset event, leading to access of invalid objects and application crash.

The vulnerability in the PDF viewing application is due to insufficient object type and argument checks when JavaScript writes annotation attributes. This corrupts the internal annotation structure and causes the application to crash during resource release.

The vulnerability involves the application re-entering the document structure during field processing, which deletes the current page. The application then continues using field objects obtained before deletion, causing an illegal read and crash.

A vulnerability in the signature plugin causes missing argument validation when copying abnormally constructed objects. JavaScript triggers signature verification, but the plugin does not validate the copied abnormal string, leading to application crash.

When opening a PDF, the application fails to validate abnormal annotation relationships and field combinations related to hyperlinks, causing internal objects to enter an invalid state. During destruction, an invalid pointer write occurs, crashing the application.