CVE Vulnerability Catalog

A vulnerability in HCL Aftermarket EPC allows email flooding due to the lack of a proper mail limitation mechanism in the Forget Password functionality. An attacker (human or bot) can send numerous requests, leading to mail server overload.

Vulnerability in the GD::SecurityImage library for Perl (versions up to 1.75) uses the rand function to generate CAPTCHA secrets. The rand function is predictable and reversible, making it unsuitable for security purposes.

A vulnerability has been found in the CIPster library of liftoff-sr, involving an out-of-bounds read in the CipAppPath::deserialize_symbolic function within cipepath.cc. The attack can be launched remotely, and exploit details have been publicly disclosed.

A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /prescriptionorderdetail.php. The attack is performed by manipulating the delid argument, allowing remote SQL injection. The exploit is publicly available.

A flaw in the Keycloak keycloak-services component, which handles identity provider management, allows a delegated administrator to update an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, enabling an attacker to redirect and capture the secret.

Mattermost Desktop App versions up to 6.2, 6.0.2, and 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App, allowing a malicious server owner to crash the Desktop App by sending a malformed method payload.

Mattermost Desktop App versions <=6.2, 5.5.13, and 6.0.2.0 fail to properly null check when validating headers, allowing any user to crash another channel member's Desktop App by posting a malicious link with an embedded image that misses one of those headers.

A security vulnerability has been detected in sagold json-schema-library versions 11.5.0 and 11.5.1, involving uncontrolled modification of object prototype attributes in the parsePropertyDependencies function of src/keywords/propertyDependencies.ts. The attack can be initiated remotely.

In Apache Accumulo 2.1.4 and 2.1.5, an authenticated low-privileged user without system permissions can remotely issue a command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, sserver), leading to a denial of service.

The HubSpot All-In-One Marketing plugin for WordPress up to version 11.3.62 exposes the plaintext HubSpot OAuth refresh token via the window.leadinConfig JavaScript object. An authenticated attacker with contributor-level access or higher can extract this token and gain access to data in the connected HubSpot tenant.

Vulnerability in ITMS 8.7.3 allows a non-administrator interactive user to achieve full SYSTEM code execution through a DCOM/task scheduler logic chain. The attack requires no network access or memory corruption.

The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller.

The Royal Addons for Elementor WordPress plugin before version 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.

The WPS Bookings for WooCommerce plugin before version 3.11.7 does not verify that a booking order belongs to the requesting user before canceling it. This allows any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.

The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to and including 2.3.2 due to insufficient input sanitization and output escaping.

The TTSSH2 plugin of Tera Term contains a vulnerability due to improper handling of length parameter inconsistency (CWE-130). When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur.

An Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in the TTSSH2 plugin of Tera Term. When Tera Term attempts to establish an SSH connection to an attacker-controlled server, out-of-bounds read/write may occur.

An improper access control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker must deploy an unauthorized file on the removable media in advance.