CVE Vulnerability Catalog

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.

A vulnerability in Cloud Foundry UAA's OAuth token endpoint allows an authenticated attacker with a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as a Bearer credential on a client_credentials grant request. UAA fails to verify that the Bearer credential is actually a client credential, accepting any valid access token with a matching client_id.

A vulnerability in Cloud Foundry UAA (versions 4.5.0 to 79.6.0) stems from insufficient verification of data authenticity in the external OIDC login callback. It allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session by submitting a valid UAA JWT as the callback's id_token parameter.

Memory corruption occurs while processing service requests.

Memory corruption occurs when executing system service routines due to improper handling of user input buffers.

Memory corruption occurs when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Transient denial of service occurs when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption occurs when processing draw objects of incorrect type during graphics command list execution.

Memory corruption occurs when accessing and modifying geographic mapping data concurrently without proper synchronization.

A cryptographic issue occurs when processing non-ELF partitions, where authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Memory corruption occurs when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

Memory corruption occurs when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. This may lead to unexpected system behavior or potential exploitation by an attacker.

The vulnerability causes memory corruption when processing camera operations due to an out-of-bounds write during driver updates.

The vulnerability causes memory corruption when processing camera CRE driver operations due to improper handling of buffer limits during hardware update preparation.

The vulnerability causes memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

The vulnerability causes memory corruption when processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory size.

A memory corruption vulnerability occurs when the non-secure loader rewrites page tables before secure memory initialization. This can corrupt memory structures used by security mechanisms.

The vulnerability causes memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

A vulnerability in Tenda AC5 router (version 02.03.01.111_multi) affects an unknown function in the file /goform/setWifi of the Wifi Handler component. Manipulation of the wifiPwd argument leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit is publicly available.