CVE Vulnerability Catalog

Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory via valid GPU memory processing operations.

A buffer overflow in the SBC_DecodeFrames() function of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted frame.

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavaScript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags.

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint.

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation.

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step.

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time.

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration.

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard.

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to and including 3.3.205 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Custom-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable when the 'Directly link to project' setting is disabled.

The Bookly plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'updateAddon' function in all versions up to and including 27.2. This allows authenticated attackers with Subscriber-level access and above to update any plugin with a main file of 'main.php' to its latest version.

The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the 'elementIds' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information from the database. The vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user to access administrative translation functionalities.

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to and including 4.3.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Improper privilege management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit allows privilege escalation and parameter injection. A local user with command line access may escalate privileges by abusing parameters of a command approved in the sudoers file. Affects versions A33.10, A33.20, and A33.30.

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This affects NanoXML version 2.2.3.