CVE Vulnerability Catalog

A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.

LibreOffice can import PICT images, which may be embedded in documents. An out-of-bounds read occurs when importing an image that uses a colour palette because the palette index is not checked against the number of entries. In fixed versions, the palette index is limited to the entries present.

In LibreOffice, URLs could be constructed that expand environment variables or INI file values, potentially exfiltrating sensitive information to a remote server when opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL naming it differently still reached the expansion. In fixed versions, the package content provider is matched when the URL is checked.

LibreOffice converts CFF fonts to Type 1 when subsetting a font, which occurs when exporting a document to PDF; CFF fonts may be embedded in documents. A stack buffer overflow exists in this conversion because converted operators are written into a fixed-size buffer without checking if they still fit. In fixed versions, the remaining capacity is tracked and conversion stops when it is used up.

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow exists when reading the hints of a glyph because the number of hints is checked against the wrong bound. In fixed versions, the hint count is checked against the actual capacity of the array.

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing a stream object because the stream length is taken from its own dictionary and not checked against the actual number of bytes present. In fixed versions, the declared length is clamped to the bytes actually read.

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing an encrypted document because the decryption key length is taken from the document's encryption dictionary and used to fill a fixed-size key buffer without being checked. In fixed versions, a declared key length larger than the buffer is rejected.

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow exists when importing a text record that carries its own character advance widths because the count of advance values and the text length are read separately and not required to agree. In fixed versions, an advance array shorter than its text is ignored.

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope, allowing an attacker to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

In Checkmk versions <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL), insufficiently protected credentials in host and folder configuration endpoints of the REST API allow an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.6.43 via the 'provider' parameter. An authenticated attacker with shop manager-level access or above can delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls.

The WP-CRM System plugin for WordPress in versions up to and including 3.4.6 is vulnerable to Sensitive Information Exposure via the 'contact_id' parameter. An authenticated attacker with contributor-level access or higher can enumerate this parameter to extract CRM contact data such as full names, email addresses, phone, mobile and fax numbers, and physical addresses.

A flaw was found in the Kerberos federation provider of Keycloak. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC), allowing an attacker on the same network to spoof the KDC and bypass authentication.

The wpForo Forum plugin for WordPress in versions up to and including 3.1.5 is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can take over another guest author's forum post and modify its title, body, author name, and stored owner email address.

The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.

The RW Elephant Rental Inventory plugin for WordPress in versions up to and including 2.3.13 is vulnerable to Missing Authorization due to a missing capability check on the toggle_cache() function hooked to the wp_ajax_toggle_cache AJAX action. An authenticated attacker with Subscriber-level access or higher can toggle the plugin's cache setting by sending a POST request to admin-ajax.

The Hostel plugin for WordPress in versions up to and including 1.1.8 is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting due to insufficient input sanitization and output escaping. An authenticated attacker with Administrator-level access can inject arbitrary web scripts into pages that execute when a user visits the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.