CVE Vulnerability Catalog

patool before version 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Rundeck before version 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory.

Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server.

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges could store manipulated arguments in the database and subsequently cause them to be processed by the revision comparison functionality.

The Pix por Piggly (para Woocommerce) plugin contains a blind SQL injection vulnerability. The issue affects versions up to and including 2.1.2.

The WordPress plugin 'Post title marquee scroll' is vulnerable to blind SQL injection in versions up to 9.9. An attacker can manipulate input to execute unauthorized database queries.

The Site Search function in Movable Type contains an SQL injection vulnerability that may allow an unauthenticated attacker to execute arbitrary SQL queries on the affected product.

Stored XSS vulnerability in the Media Library Assistant plugin by David Lingren. Improper input neutralization during page generation allows persistent execution of malicious scripts in the victim's browser.

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.

Apache YuniKorn up to 1.9.0 does not enforce label and user annotation checks for workload UPDATE actions, bypassing all checks. This allows any user to set arbitrary user annotations and change the application ID, potentially gaining access to queues they normally cannot access. Upgrade to version 1.10.0 is recommended.

Apache YuniKorn 1.8.0 and later, when configured with the LDAP group resolver, crashes due to an out-of-bounds read processing group membership entries. If the LDAP server returns a memberOf attribute for a user and the record does not start with "CN=", the server crashes. This only affects installations with the non-default LDAP group provider. Upgrade to version 1.10.0 is recommended.

The affiliate-toolkit-starter plugin by SERVIT Software Solutions contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 3.9.1.

The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.

The WP Rentals plugin (versions up to and including 3.14.2) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects WP Rentals from n/a through 3.14.2.

Stored XSS vulnerability in the Rocket Lazy Load plugin by WP Media Rocket. Improper input neutralization during page generation allows persistent execution of malicious scripts.

The Modula Image Gallery plugin for WordPress contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 3.0.11.

The Prime Slider – Addons For Elementor plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 4.6.2.

The Element Pack Elementor Addons plugin for WordPress has a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 8.8.6.