CVE Vulnerability Catalog

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. The fix is available in version 4.3.4, including snowflake-jdbc-fips and snowflake-jdbc-thin, and requires manual upgrade.

Missing Authorization vulnerability in MarketKing by Kings Plugins allows exploiting incorrectly configured access control security levels. Affects versions through 2.1.60.

Missing Authorization vulnerability in WCFM Membership by WC Lovers allows exploiting incorrectly configured access control security levels. Affects versions through 2.11.11.

Authorization Bypass Through User-Controlled Key vulnerability in WP Rentals by sc Internet Vivoo allows exploiting incorrectly configured access control security levels. Affects versions before 3.16.0.

In Checkmk versions before 2.5.0p10, improper certificate validation allows a relay and a push agent sharing the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

Apache SkyWalking Booster UI (part of Apache SkyWalking UI) versions 10.2.0 through 10.4.0 are vulnerable to cross-site scripting (XSS) due to improper neutralization of input during web page generation. The product is marked as UNSUPPORTED WHEN ASSIGNED.

Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.

Pik Online Portal through version 3.5.1 uses a one-way hash without salt, which enables cryptanalysis attacks. The vulnerability affects Pik Online Software Solutions Inc. Pik Online Portal.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before version 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

The Ninja Forms WordPress plugin before version 3.15.2 does not restrict its REST abilities to administrators, treating a plugin-specific capability as equivalent to full site administration. This allows any user granted that capability to read settings and stored submissions, overwrite configuration, and create or modify arbitrary posts and pages.

Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.

The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

The WPFunnels WordPress plugin before version 3.13.0 does not restrict access to log files it writes to a predictable location under the public uploads directory. This allows unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

The WPFunnels WordPress plugin before version 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for. This allows unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

The Pods WordPress plugin before version 3.3.9.2 does not restrict which functions a display callback may resolve to. This allows users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

The PagerDuty alarm hook in Apache SkyWalking transmits the integration routing key over cleartext HTTP. Although PagerDuty serves over HTTPS and normally redirects plain HTTP to HTTPS, the initial POST request with the JSON body containing the routing key is sent unencrypted before any redirect response is received. The issue affects versions from 9.6.0 through 11.0.0.