CVE Vulnerability Catalog

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could exploit this, leading to client-side request forgery.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an OS Command Injection vulnerability. A low privileged attacker with remote access could exploit this to elevate privileges.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could exploit this to gain unauthorized access.

In Apache Parquet versions 1.12 to 1.18, in the org.apache.parquet.crypto.keytools package, there is a vulnerability where if the user does not leverage application control for the KMS URL parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2.

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of core-site.xml. The secret's key must be known to the user.

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, and Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This affects versions from 1.11 through 1.22.

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. Fixed in bubblewrap 0.12.0.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Several Newfold plugins are vulnerable to Authentication Bypass due to the wp-module-data module. The authenticate() method degenerates when HiiveConnection::get_auth_token() returns false, allowing unauthenticated attackers to compute a valid token and gain administrator access. Vulnerable versions: Crazy Domains (<= 2.5.2), Web (<= 2.3.4), Hostgator (<= 3.1.0), Bluehost (<= 4.17.1).

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access.

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The YITH WooCommerce Waitlist Premium plugin for WordPress up to version 3.35.0 is vulnerable to Privilege Escalation. The add_user_in_waiting_list() function lacks capability checks and nonce verification, and uses parse_str() and extract() to import attacker-controlled variables, allowing authenticated attackers with Subscriber-level access to create an administrator account and assign the administrator role.