CVE Vulnerability Catalog

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

In the Kit (formerly ConvertKit) for WooCommerce plugin versions up to 2.2.0, there is a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 contains a Server-Side Request Forgery (CWE-918) vulnerability. It may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

In Progress Telerik Fiddler Classic for Windows prior to version 6.0.20262.10021, the integrity check for external helper tools is insufficient. The application only verifies the Authenticode signature and publisher name, not that the file is the specific executable shipped with the product. A local attacker with low privileges can replace a helper executable with another validly signed binary from an allow-listed publisher, causing it to be executed, including with Administrator privileges.

In Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021, a TOCTOU race condition exists during installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the elevated TrustCert helper to import it.

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request containing both Content-Length and Transfer-Encoding headers is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.

In Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests with multiple conflicting Content-Length headers are forwarded verbatim to the origin server, while Fiddler frames the body using only the first value.

In django-haystack up to 3.3.0, a vulnerability was found in the _to_python function in elasticsearch_backend.py, in the more_like_this template tag handler component. Manipulation of the result_class argument leads to improper neutralization of directives in dynamically evaluated code.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

A vulnerability in LibreOffice allows crafting URLs that expand environment variable or INI file values, potentially leaking sensitive information to a remote server when a document containing such links is opened. The fix for CVE-2024-12426 did not cover all places where a document can supply a URL, and XForms instance data and Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early but did not respond.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution allows retrieving embedded sensitive data. This issue affects WP Event Solution from n/a through 4.1.25.

Missing Authorization vulnerability in Arraytics WP Event Solution allows exploiting incorrectly configured access control security levels. This issue affects WP Event Solution from n/a through 4.1.25.

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.