CVE Vulnerability Catalog

A vulnerability in GitLab CE/EE allows an authenticated user to conceal content within a Snippet due to improper input validation. The issue affects versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.

An incorrect authorization issue in DAST site profile management in GitLab EE could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.

The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_id' parameter in all versions up to and including 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'configurablePrefix' Block Attribute. This issue affects all versions up to and including 6.1.4 due to insufficient input sanitization and output escaping.

The Tcpdump plugin for Rapid7 InsightConnect on Linux is vulnerable to OS command injection. An authenticated attacker can execute arbitrary commands via the options or filter parameters due to insufficient input sanitization.

The Finger plugin for Rapid7 InsightConnect on Linux contains an OS Command Injection vulnerability. An authenticated attacker can execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.

Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.

The RPM plugin for Rapid7 InsightConnect on Linux contains an OS command injection vulnerability. An authenticated attacker can execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization.

The SQLmap plugin for Rapid7 InsightConnect on Linux contains an OS command injection vulnerability. Authenticated attackers can execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.

A NULL pointer dereference vulnerability was found in the gf_filter_in_parent_chain function of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted file.

A use-after-free vulnerability was found in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted media file.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in package_import.php. This issue has been fixed in version 1.2.31.

A vulnerability in the uploadSSL method of ATEN Unizon allows remote authenticated attackers to delete arbitrary files. The issue stems from missing validation of a user-supplied path before using it in file operations.

The vulnerability in the updateLicense method of ATEN Unizon software allows a remote authenticated attacker to delete arbitrary files on the system. The issue stems from the lack of proper validation of a user-supplied path before using it in file operations.

SiYuan is a knowledge management system that prior to version 3.7.0 had the /api/icon/getDynamicIcon endpoint which did not require authentication. Attackers can exploit this endpoint to execute arbitrary SELECT queries against the SiYuan SQLite database, leading to data leakage.

Vulnerability in Chrome DevTools MCP (versions 0.24.0 to 1.1.0) allows bypassing workspace root restrictions via symbolic links. The path validation function does not canonicalize symbolic links, enabling read and write access to files outside the allowed area.

A vulnerability in chrome-devtools-mcp from version 0.20.0 to 1.1.0 allows a local low-privilege user to create a symbolic link to the daemon PID file, resulting in overwriting any victim's file with the daemon PID string.

A vulnerability in Tiptap for PHP before version 2.1.1 allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string. This triggers an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(), potentially corrupting records and permanently crashing the HTML rendering pipeline for all viewers.