CVE Vulnerability Catalog

Relative Path Traversal vulnerability in Dell SCG 5.0 Appliance (before 5.36.00.16) and Dell SCG 5.0 Application (before 5.36.00.00). A low privileged attacker with remote access could exploit this, leading to remote code execution.

A flaw in 389 Directory Server in the SELFDN ACI bind-rule evaluator. An anonymous LDAP client's empty bind DN is incorrectly matched against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended for authenticated identities. This can allow anonymous clients to perform operations like adding or modifying entries that should be restricted to specific authenticated users.

Privilege escalation vulnerability in the WP Fusion (Pro) plugin for WordPress, in all versions up to and including 3.47.13. Due to insufficient authorization checks on the role parameter in the thrivecart() function of the ThriveCart Auto Login handler. Authenticated attackers with Subscriber-level access and above, who possess the access_key, can create a new administrator account and gain full control over the WordPress site. The access_key is intentionally shared with ThriveCart customers as part of the setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.

Denial of service vulnerability in the Footnote extension of commonmark versions from 1.5.0 before 2.8.4. Lack of deduplication of footnote definitions allows attackers to craft documents with duplicates, leading to quadratic output expansion and excessive memory and CPU consumption.

Denial of service vulnerability in league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) in UniqueSlugNormalizer::normalize(). On slug collision, the numeric-suffix search restarts from 1, resulting in O(K^2) time complexity for K headings collapsing to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered.

Denial of service vulnerability in the Attributes extension of commonmark versions from 1.5.0 before 2.8.4. AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

Cross-site scripting vulnerability in AttributesExtension of league/commonmark versions >= 2.7.0 and < 2.9.1. Prefixing an attribute name with a single U+000C form feed byte bypasses the AttributesHelper::filterAttributes() 'on*' filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false.

Multiple denial of service vulnerabilities in league/commonmark before 2.9.1 in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

The league/commonmark library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service.

Denial of service vulnerability in commonmark versions from 1.5.0 before 2.10.0 in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.

A weakness has been identified in light0011 cms in the file App/Home/Model/UserModel.class.php of the Cookie Helper component. Manipulation of the Username argument leads to improper authentication. The attack can be performed remotely, and the exploit is publicly available.

A security flaw has been discovered in light0011 cms in the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Manipulation results in unrestricted upload. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was determined in 92181 markdown up to version 058cab0cb7fb245a0ccc6b8446963ff8d573558f. The function lds in file md.c is affected. Manipulation can lead to out-of-bounds read. The attack can be executed remotely. A patch is available as c000d2f9cf390c315378d3717cf20911cf3e80a6.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.