CVE Vulnerability Catalog

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. Affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. Affects versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API, which is available to all default roles. Affects versions from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. Affects versions from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Sensitive information exposure vulnerability in Apache CloudStack's OAuth authentication plugin when listing OAuth providers. Affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Missing authorization and sensitive information exposure in Apache CloudStack's userdata-related APIs. Several APIs, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, have missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources. Affects versions from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behavior.

SSRF via Metalink mirror URL resolution and RCE on KVM hypervisor. An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file. Additionally, an authenticated tenant with the default User role can execute arbitrary shell commands as root on the KVM hypervisor host. Affects versions from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

OS Command Injection vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a backup restore. Affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel through 28072026.

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the plugin-installation capability, allowing users such as Shop Managers to install and activate arbitrary plugins from WordPress.org.

In Rocket.Chat before versions 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the REST API endpoint POST /api/v1/livechat/visitor accepts an unauthenticated, unsanitized name field. This name is stored raw and rendered via dangerouslySetInnerHTML, injecting a clickable HTML link into the DOM of any agent viewing the queue.

Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages, leading to OOB read and/or write due to improper validation. This could lead to 4K pages being treated as higher order pages and allowing access beyond the 4K threshold.

Kernel software running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. This can result in out of bounds memory accesses and be used to escalate privileges.

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects specific versions before the indicated revisions.

A Server-Side Request Forgery (SSRF) vulnerability in PTC Windchill PDMLink and PTC FlexPLM may be exploited through deserialization of untrusted data.