CVE Vulnerability Catalog

In Eclipse KUKSA Databroker version 0.6.1, the `kuksa.val.v2.VAL/PublishValue` gRPC handler fails to validate the existence of the optional `data_point` field in `PublishValueRequest`. When a request contains a valid `signal_id` but omits `data_point`, the server calls `unwrap()` on `request.data_point`, causing a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token.

Eclipse Grizzly before version 5.0.2 improperly parses the trailer section in malformed headers, allowing HTTP request smuggling. Version 5.0.1 includes system properties that fix the vulnerability.

A SQL injection vulnerability was found in itsourcecode Electronic Judging System 1.0 in the file /intrams/admin/add_judges.php. An attacker can remotely manipulate the fname argument, leading to SQL injection. The exploit has been publicly disclosed and may be used.

A vulnerability was found in louisho5 picobot up to version 0.2.0, affecting the ExecTool.Execute function in internal/agent/tools/exec.go, allowing OS command injection. The attack requires local access, and the exploit has been made public.

The WP 2FA WordPress plugin before version 3.1.1.2 does not verify that the email address provided during two-factor authentication setup belongs to the user. This allows an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.

A vulnerability in Keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Symlink entries are not validated for directory escape, enabling symlink-based file read, overwrite, or directory escape attacks.

The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

The Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end. The value is passed through do_shortcode, which echoes non-shortcode content verbatim, allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.

A vulnerability was found in picobot up to version 0.2.0, affecting the WebTool.Execute function in internal/agent/tools/web.go. Manipulation of the url argument leads to server-side request forgery (SSRF). The project has not responded to the issue report.

A link following vulnerability has been found in the Workspace Handler component of louisho5 picobot up to version 0.2.0. The issue affects the CreateSkill/GetSkill functions in internal/agent/tools/filesystem.go. The attack can be performed remotely and the exploit has been made public.

A server-side request forgery (SSRF) vulnerability has been discovered in the Vision Tool component of zhayujie chatgpt-on-wechat CowAgent up to version 2.1.1. The issue affects the Vision._download_to_data_url function in agent/tools/vision/vision.py, where manipulation of the image argument allows remote attack execution. A public exploit is available, increasing the risk of exploitation.

A vulnerability was found in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 in the handleNavigate function of the pkg/browser/tool.go file. Manipulation of the args.targetUrl argument leads to information disclosure. The attack can be performed remotely and the exploit is publicly available.

A path traversal vulnerability was found in GoClaw 3.13.3-beta.3 by nextlevelbuilder in the writeFile function of internal/providers/acp/tool_bridge.go within the ACP ToolBridge Workspace Handler component. The attack can be carried out remotely, and the exploit has been publicly disclosed.

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute.

A vulnerability was found in GoClaw 3.11.3 in the ExecApprovalManager.CheckCommand function in internal/tools/exec_approval.go. Manipulation results in an incomplete blacklist, allowing remote attack execution. The exploit has been made public and could be used.

A vulnerability was found in GoClaw 3.13.3-beta.3 in the bytePlusDownloadVideo function of internal/tools/create_video_byteplus.go. Manipulation of the output.video_url argument leads to server-side request forgery (SSRF). Remote exploitation is possible and the exploit has been publicly disclosed.

A flaw in poco-ai poco-claw up to version 0.5.4 affects the get_workspace_file function in executor_manager/app/api/v1/workspace.py. Manipulating the user_id argument can lead to authorization bypass.

The FoodBook Lite - Online Food Ordering System plugin for WordPress up to version 1.5.6 has a missing authorization vulnerability in the registration function. The registration() function accessible via AJAX lacks nonce verification and capability checks, allowing unauthenticated attackers to create user accounts with the 'customer' role and receive authentication cookies even when user registration is disabled.

The News Kit Addons For Elementor plugin for WordPress up to version 1.4.6 is vulnerable to Stored Cross-Site Scripting. The flaw exists in the Site Logo Title and Single Author Box widgets due to insufficient input sanitization and output escaping.

In SAP S/4HANA, the Draft operation does not perform necessary authorization checks for an authenticated user. A restricted user could access information within the entity, resulting in escalation of privileges.