CVE Vulnerability Catalog

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache to write past it and into the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed.

Joomla Extension - OrdaSoft Simple Membership before 7.4.0 has an unauthenticated SQL injection vulnerability. The site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control. The handler reads a login parameter through Joomla's generic non-sanitizing input filter, which strips HTML/script tags but not quotes or SQL syntax, and concatenates it directly into a query without escaping or parameterization.

The Joomla extension OrdaSoft Touch Slider (before 5.4.6) has an unauthenticated destructive CRUD vulnerability. The function modOsTouchSliderHelper::getAjax() is the single handler for data operations, with no user check, authorization, or CSRF token. An unauthenticated attacker can delete slider images and replace entire database tables.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

Vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to write files to arbitrary locations when an administrator installs it.

A flaw in the SMTP email configuration handling of the keycloak-services component. When STARTTLS is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing fallback to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic could capture sensitive email credentials and message content in plain text.

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present, this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

The Optimole WordPress plugin before version 4.2.15 does not perform a capability check before exposing stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.

The MetForm WordPress plugin before version 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.

The WordPress plugin WPCafe (before 3.0.21) does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitize and escape user input in some AJAX actions available to unauthenticated users, leading to Reflected XSS.

The MPG WordPress plugin before version 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.