CVE Vulnerability Catalog

Memcached before version 1.6.42 uses the memcmp function for password comparison in SASL authentication, causing a timing side-channel vulnerability. An attacker can read passwords by measuring response times.

In memcached before version 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

A broken access control issue in Talend Administration Center allows a user with 'View' permission to modify the Talend Studio update URL. This issue has been resolved in an available patch.

The Advanced Database Cleaner – Premium plugin for WordPress versions up to and including 4.1.0 contains a Local File Inclusion (LFI) vulnerability via the 'template' parameter. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary .php files on the server.

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to 2.0.3. Insufficient escaping and lack of prepared statements allow unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive database information.

E-LAN Hybrid Recording System by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend that allows an attacker to cause an integer overflow. Successful exploitation could lead to code execution, data tampering, or denial of service.

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend that allows an attacker to cause an out-of-bounds read. Successful exploitation could lead to code execution, data tampering, denial of service, or information disclosure.

NVIDIA Triton Inference Server contains an integer overflow vulnerability that an attacker could exploit to cause denial of service.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Triton Inference Server contains a vulnerability that allows an attacker to bypass authentication. Successful exploitation could lead to privilege escalation, denial of service, or information disclosure.

NVIDIA TRT-LLM contains a vulnerability in RPC testing that allows unsafe deserialization, potentially leading to code execution, denial of service, data tampering, and information disclosure.

NVIDIA TRT-LLM for any platform contains a vulnerability in the MPI server that could allow an attacker to cause unsafe deserialization. A successful exploit might lead to code execution, denial of service, data tampering, and information disclosure.

The Read More & Accordion plugin for WordPress up to version 3.5.7 contains a privilege escalation vulnerability. The RadMoreAjax::importData function does not restrict which database tables can be written to during import and does not properly validate imported data. An authenticated attacker with appropriate permissions can insert arbitrary rows into the wp_users and wp_usermeta tables, including the wp_capabilities field, creating a new administrator account.

The Account Switcher plugin for WordPress versions up to and including 1.0.2 contains a privilege escalation vulnerability. This is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for secret validation, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the comparison (`'' != ''` is `false`), and the endpoint then calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => '__return_true'` with no capability checks. This makes it possible for authenticated attackers with Subscriber-level access and above to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow. A malicious sender can trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness.

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress versions up to 1.6.9 contains an SQL injection vulnerability via the 'checkout_uuid' parameter. This is due to insufficient escaping and lack of proper query preparation in the has_checkout_consent() method.

MantisBT versions up to 2.28.1 contain a stored XSS vulnerability. When cloning an issue from another project, the source project name is displayed without proper escaping, allowing an attacker with manager or administrator privileges to inject HTML.

CtrlPanel 1.1.1 and prior contains a broken access control vulnerability where admin controllers enforce permission checks on form display methods but omit them on corresponding write methods (store/update), allowing any authenticated user to bypass RBAC via direct POST/PATCH requests.