CVE Vulnerability Catalog

Denial of Service and resource exhaustion vulnerability in the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated attacker can send excessively long data streams, causing massive memory and CPU consumption, potentially leading to a crash or system hang.

The product accepts user input in a URL parameter without proper encoding before rendering it in the response, allowing injection of malicious JavaScript. An attacker can redirect the user to a malicious site, modify the UI, or steal browser data.

The Elementor Website Builder WordPress plugin before version 4.1.4 fails to properly check user permissions before returning post data via one of its REST endpoints. This allows authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, and drafts authored by other users (including administrators).

The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.

The MailerSend WordPress plugin before version 1.0.8 does not perform a nonce check on its configuration-delete action, allowing an attacker to trick a logged-in administrator into visiting a crafted page that wipes the SMTP configuration and deactivates the plugin, breaking email delivery.

The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX actions available to unauthenticated users. This allows disclosure of the secret order key of arbitrary WooCommerce orders and, under some configurations, modification of order statuses.

The PayPlus Payment Gateway WordPress plugin before version 8.2.2 lacks authorization and order-ownership validation in one of its AJAX endpoints available to unauthenticated users. This allows tampering with payment metadata of arbitrary WooCommerce orders.

The All-in-One WP Migration and Backup WordPress plugin before version 7.106 does not properly sanitize a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

The Kirki WordPress plugin before version 6.0.12 does not sanitize or escape the email subject and body values supplied in a request before including them in the password-reset email sent as HTML. This allows unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

The Kirki WordPress plugin before version 6.0.12 does not perform any authorization check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

The WordPress Reviews Feed plugin before 2.6.5 does not neutralize WordPress shortcodes in third-party review content before rendering. An unauthenticated attacker can plant a shortcode in a review on the connected source, allowing arbitrary shortcode execution on pages displaying the feed.

CI4MS before version 0.31.9.0 has a stored XSS vulnerability. The custom `html_purify` validation rule relies on by-reference mutation, but CodeIgniter 4 passes a local copy, so sanitized text is discarded. The Blog controller writes unsanitized content directly into the database, and the template echoes it without escaping, allowing script execution in any visitor's browser.

In the Linux kernel, a vulnerability in sysfs causes an existing group directory to be removed when sysfs_update_group() fails (e.g., -ENOMEM). The internal_create_group() function incorrectly deletes a directory that was not created by the caller, potentially destroying pre-existing sysfs groups.

In the Linux kernel, a cgroup reference leak was discovered in the DAMON sysfs-schemes module. The function damon_sysfs_memcg_path_to_id() breaks the mem_cgroup_iter() loop without calling mem_cgroup_iter_break(), causing a reference leak. The issue is fixed by adding the missing call.

In the Linux kernel, a vulnerability was found where the EFI runtime workqueue was allocated too late, causing a NULL pointer dereference when ACPI PRM calls were made early during boot. The fix moves the workqueue allocation to an earlier initcall (postcore).

In the Linux kernel, a memory block device reference leak was found in memblk_nr_poison_inc() and memblk_nr_poison_sub(). These functions look up a memory block via find_memory_block_by_id() but fail to drop the reference after updating the hwpoison counter.

In the Linux kernel, a memory block device reference leak was found during memory removal. The function remove_memory_blocks_and_altmaps() acquires a reference via find_memory_block() but never releases it, causing a device reference leak.

In the Linux kernel, a memory leak was found in the iosm WWAN driver in the ipc_imem_init() function. Memory allocated in ipc_protocol_init() is not freed on error paths, potentially leading to resource exhaustion.

In the Linux kernel, a vulnerability was found in the Phonet/PEP subsystem where pep_do_rcv() calls sk_receive_skb() for a child socket without disabling bottom halves (BH). This causes a lock inconsistency (SOFTIRQ-ON-W vs IN-SOFTIRQ-W), potentially leading to a deadlock in the network receive path.