CVE Vulnerability Catalog

In the Bluetooth host stack, during L2CAP LE CoC SDU reassembly, a remote unauthenticated BLE peer can trigger a 2-byte out-of-bounds write. This occurs when segmentation is enabled and the chosen RX pool has user_data_size smaller than 2 bytes, causing the segmentation counter to be written out of bounds in l2cap_chan_le_recv_seg.

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in the `recover_exit()` function. This makes it possible for unauthenticated attackers to perform path traversal and include unintended local PHP files, which can lead to sensitive information exposure and, in certain deployment chains, code execution.

The 6Storage Rentals plugin for WordPress up to version 2.22.0 allows unauthenticated attackers to read and modify tenant profile data (including name, email, phone, address, and SSN) via the userId parameter in AJAX actions six_storage_get_user_info and six_storage_update_profile. No ownership, session, or nonce validation.

In an untrusted JMS environment, MappingJackson2MessageConverter and JacksonJsonMessageConverter in Spring Framework allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Vulnerability in Spring Framework allows a DoS attack via specially crafted SpEL expressions, causing excessive resource consumption.

An integer overflow vulnerability exists in the Spring Expression Language (SpEL). An attacker can supply a specially crafted SpEL expression causing excessive resource consumption, leading to a Denial of Service (DoS).

The JavaScriptUtils.javaScriptEscape() function in Spring Framework incorrectly escapes data, potentially leading to JavaScript code injection in the browser and an XSS vulnerability. Affected versions: 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password, allowing authentication without a valid password.

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: 1.5.0–1.5.6, 2.3.0–2.3.4, 2.4.0–2.4.1, 2.5.0–2.5.2, and 3.0.0–3.0.3.

Spring HATEOAS's PropertyUtils.createObjectFromProperties method, used by Collection+JSON and UBER deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, 3.0.0-3.0.3.

A vulnerability in Micrometer allows remote denial of service (DoS) via specially crafted HTTP requests. Affects multiple versions of micrometer-core, micrometer-jetty11, and micrometer-jetty12.

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.

A missing authorization vulnerability in QuMagie allows remote attackers to access unauthorized data or perform unauthorized actions. The issue is fixed in version 2.9.0.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment text in all versions up to 7.5.49.7212 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute after an administrator approves the comment.

DTStack Taier up to version 1.4.0 has a vulnerability in the preHandle function in LoginInterceptor.java related to the source connection test endpoint. Remote exploitation can bypass authentication. Exploit publicly disclosed.

Rapid7 Velociraptor before version 0.76.6 contains a YAML injection vulnerability. An attacker can supply a crafted ZIP file that, when applied by an analyst, executes arbitrary VQL code with full privileges.

The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.

Use-after-free vulnerability in the Tracing component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.