CVE Vulnerability Catalog

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). A high-privileged attacker with local access could exploit it, leading to code execution and filesystem access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this to cause information disclosure, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker with remote access could exploit it to cause information disclosure, protection mechanism bypass, SSRF, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Authorization Bypass Through User-Controlled Key vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges.

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space left by the IV. With a 13- to 15-byte IV the counter is only 1 to 3 bytes, so for longer input the counter wrapped and the keystream repeated from the start of the same packet. The call still returned the full input length as though every byte had been correctly transformed, with no exception and no short length.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to information disclosure and exposure.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit it to cause denial of service, information disclosure, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges, filesystem access, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to information tampering and protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could exploit this vulnerability, leading to information exposure and information tampering.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to information tampering.