CVE Vulnerability Catalog

Strapi versions 5.47.0 through 5.57.0 contain an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.

WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

Tainacan through version 1.3.0 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data. This issue affects WP Rollback: from n/a through 3.1.2.

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

Forminator by WPMU DEV through version 1.57.3 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl may read the SV length before stringifying the argument. Due to unspecified evaluation order in C++, some compilers may evaluate SvCUR on a non-string, leading to abort or segfault.

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble after checking only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. This can cause a crash (denial of service) and could expose adjacent memory contents. Affects versions from 2.0.0-incubating before 5.3.0.

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking input length; in the compressed format the size check could be defeated by a 32-bit overflow. A crafted or truncated sketch could cause a read past the end of the input, potentially large in the compressed case, leading to a crash and memory exposure. Affects versions from 3.1.0 before 5.3.0.

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize() can cause the decompressor to read past the end of compressed data, and in the hybrid flavor can cause a write outside an internal heap buffer due to unvalidated decoded row indices. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. Affects versions from 2.0.0-incubating before 5.3.0.

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (datasketches-cpp). When deserializing a sketch in LIST mode, the coupon count was read from input and used as the number of entries to copy into a fixed buffer of 8 entries without checking capacity. A crafted sketch could cause a write of up to 988 bytes past the end of the internal heap buffer, corrupting memory. Affects versions from 1.0.0-incubating before 5.3.0.

ZTE Z80 Ultra's system interfaces lack robust invocation authentication and have inadequate access control. Third-party apps may call these interfaces through reflection and retrieve relevant information.