CVE Vulnerability Catalog

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster's ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

The Simple Ajax Chat plugin for WordPress (versions up to and including <= 20260811) is vulnerable to Stored Cross-Site Scripting via chat messages due to insufficient input sanitization and output escaping. The nonce protecting chat message submission is publicly visible on the chat page, allowing unauthenticated attackers to persistently inject malicious scripts.

The Vigilant – 100% Free Security Suite plugin for WordPress (versions up to and including 2.10.2) is vulnerable to Stored Cross-Site Scripting via the User-Agent header due to insufficient input sanitization and output escaping. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header.

The UsersWP plugin for WordPress (versions up to and including 1.2.70) is vulnerable to Arbitrary File Deletion via the upload_file_remove() AJAX handler. An authenticated attacker with Subscriber-level access or above can delete arbitrary files on the server, including wp-config.

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.2.08.003) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter due to insufficient input sanitization and output escaping. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger, making the exploit fully reachable by unauthenticated callers.

The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

The Sticky Chat Widget plugin for WordPress (versions up to and including 1.4.2) is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

Zenius EMS 8.0 (through OAM Build 109) contains an authentication bypass using an alternate path or channel and improper validation of syntactic correctness of input, allowing Remote Code Inclusion.

strongSwan 4.5.0 through 6.0.7 has incorrect access control in the eap-ttls and eap-peap plugins because the inner EAP identity may be missing or mismatched.

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.

The AcyMailing plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` parameter. This allows unauthenticated attackers to read arbitrary files on the server. Exploitation requires the "Embed images" option to be enabled.

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability.

Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.