CVE Vulnerability Catalog

A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.

A security vulnerability in HPE NonStop EXPAND may cause an out-of-bounds memory read resulting in a buffer overflow.

The PhastPress plugin for WordPress in all versions up to and including 3.10 is vulnerable to Server-Side Request Forgery (SSRF). The scripts service endpoint constructs its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header, allowing bypass of the whitelist and forcing requests to arbitrary destinations.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping.

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. Missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks, makes it possible for unauthenticated attackers to upload files that may be executable, leading to remote code execution.

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. Lack of validation of the ContentSearch parameter (expected to be "AND" or "OR") in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB allows injection of arbitrary SQL commands.

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations.

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() uses these attacker-controlled values as memcpy lengths, causing an out-of-bounds read of kernel memory that is disclosed in the ARP reply.

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected.

A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption. This may result in a denial of service (DoS).

A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down.

The Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression, and shell command substitution is then evaluated by a popen() pipeline as root.

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. The token browser does not sufficiently limit access to the types of tokens that are available, although the names of individual tokens are adequately protected.

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools such as browse_webpage, search_web, and torrent metadata parsers. The content is passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell, and attackers can bypass the validate_command_safety denylist and exploit the admin session's is_admin context.