CVE Vulnerability Catalog

An information disclosure vulnerability in the Palo Alto Networks Prisma Access Agent on Linux enables a local user to access sensitive configuration data and credentials.

An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts. This occupies a shared broker thread and leads to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

When the broker processes message-based management requests sent by an authenticated messaging client authorized with MANAGE permission, parameter processing can trigger Java deserialization of certain method parameters the broker will not use. The permitted types allow crafting a payload that causes excessive computation and pins the processing thread, leading to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.3.0 through 2.44.0.

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to and including 2.0.4. The plugin registers this field with show_in_rest enabled but without a sanitize_callback, and outputs unsanitized data directly into <style> tags on the frontend.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.1.0 via the 'backup_file' parameter. An authenticated attacker with administrator-level access or above can read arbitrary files on the server, including sensitive information.

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to and including 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without capability or nonce verification, and the post_id is sourced directly from user input.

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Photo Module 'attributes' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'bg_video_service_url' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API parameters (interval, format, emailTo) in all versions up to and including 3.0.3 due to insufficient input sanitization and output escaping. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of files with dangerous types. If exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code execution.

BurgerEditor versions 3.0.0 through 3.4.0 contain an authorization bypass issue through a user-controlled key. If exploited, an attacker who can log in to the product may alter page content.

A cross-site scripting (XSS) vulnerability was found in the Rizwan17 inventory-management-system in the index.php file of the Login Page component. Manipulating the msg argument allows script injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A security vulnerability in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f affects the file includes/invoice_bill.php in the Invoice Generation component, where manipulation of arguments order_date/invoice_no leads to missing authentication, allowing remote attack.

In the inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, a cross-site scripting vulnerability was found in includes/DBOperation.php of the List Handler component. Manipulation of category_name/brand_name/product_name arguments allows remote attack. The exploit is public, and the project has not responded.

A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.

Open WebUI from 0.5.0 to 0.11.1 has a vulnerability causing infinite loop in the message-chain reconstruction helper in backend/open_webui/utils/misc.py. An authenticated user can store id-less messages in a cyclic structure, blocking the event loop and growing memory until termination. Fixed in 0.11.1.

Open WebUI from 0.9.5 to 0.11.1 fails to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect fetches to excluded hosts, loopback, private networks, or cloud metadata services, and route content into various features. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 has an infinite loop vulnerability in the chat deletion helper in backend/open_webui/models/chats.py. An authenticated user can create a cyclic chat tree and delete a message, causing a synchronous infinite loop that blocks all user requests until process termination. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 fails to apply folder write-access checks when creating a new chat with a client-supplied folder_id in POST /api/chat/completions and POST /api/v1/chat/completions. An authenticated user who knows a shared folder identifier can inject a chat into a folder where they have read-only or no write access, causing the entry to appear to authorized readers. Fixed in 0.11.1.