CVE Vulnerability Catalog

The Kirki plugin for WordPress up to version 6.0.14 contains an Insecure Direct Object Reference vulnerability via the 'context' parameter, allowing unauthenticated attackers to read the title, content, and excerpt of any WordPress post, including drafts, pending, private, password-protected, and trashed posts.

ZenML versions 0.57.0 through 0.94.2 have a vulnerability that allows bypassing rate-limiting on login and password change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from this header.

The Participants Database plugin for WordPress up to version 2.7.8.3 is vulnerable to Sensitive Information Exposure via the 'id' parameter. An unauthenticated attacker can overwrite any participant record and hijack the private access link, gaining full read and edit access to personal data.

The MapSVG plugin for WordPress up to version 8.14.0 is vulnerable to stored XSS via user-supplied attributes in map options. Insufficient sanitization and escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute on every visit to the injected page.

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability that could allow an attacker to steal admin credentials via weak hash or pass-the-hash attack.

Pronetiqs IntraVUE versions 3.2.1a14 and prior expose sensitive system information to unauthenticated users, allowing asset discovery.

A vulnerability was detected in Ne-Lexa php-zip up to version 4.0.2 in the function ZipFile::extractTo in the file src/ZipFile.php in the ZIP Handler component. Manipulation of the argument entryName results in path traversal. The attack can be initiated remotely. The exploit is publicly available.

OWASP DefectDojo version 2.59.0 has a vulnerability in the UserSerializer function in dojo/api_v2/serializers.py, where manipulation of the is_staff argument leads to improper privilege management. The attack can be performed remotely and the exploit is publicly available.

A vulnerability in localstack serverless-localstack up to version 1.4.0 allows OS command injection via the custom.localstack.docker.compose_file argument in the Configuration Handler component. The attack requires local access and the exploit is publicly available.

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame with a malformed TLV value.

In Knot DNS before versions 3.4.10 and 3.5.4, the mod-onlinesign module incorrectly computes the next NSEC owner name, creating an overly broad authenticated denial interval. This allows downstream resolvers using aggressive negative caching to synthesize negative answers for legitimate names, causing resolver-side denial of service.

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

Shopware prior to versions 6.6.10.18 and 6.7.10.1 contains an SSRF vulnerability in the `/api/_action/media/external-link` endpoint. An authenticated admin can send HEAD requests to arbitrary internal IPs because the `linkURL` flow only performs a URL format check (regex for http/https prefix), while the `uploadFromURL` flow properly blocks private addresses.

In Shopware versions 6.7.3.0 through 6.7.10.0, an open redirect vulnerability exists in the SSO endpoint `/api/oauth/sso/auth`. When the expected SSO session state is missing, the application uses the `Referer` header as the redirect target without validation, allowing an attacker to control the destination URL, including dangerous schemes like `javascript:`.

An unauthenticated attacker can trigger an Out of Memory condition crashing the Java process of RHCS by repeatedly sending HTTP requests to the TLS endpoint. Manual restart may be required depending on configuration.

Datasets up to version 5.00 (fixed in commit ad2d853) has a symlink-following vulnerability in Extractor.extract(). A local attacker can pre-plant symlinks at predictable output paths to write arbitrary files outside the target directory.

A path traversal vulnerability was found in Diffusers up to version 0.39.0 in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in model index JSON, containing ../ sequences or absolute paths, allowing reading of safetensors files outside the intended directory.

The Joomla extension Phoca Maps versions 5.0.0-6.0.4 contains a Reflected XSS vulnerability due to improper validation of user inputs.

The Joomla extension Phoca Guestbook versions 5.0.0-6.1.0 contains a Reflected XSS vulnerability due to improper validation of user inputs.