CVE Vulnerability Catalog

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early but did not respond.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution allows retrieving embedded sensitive data. This issue affects WP Event Solution from n/a through 4.1.25.

Missing Authorization vulnerability in Arraytics WP Event Solution allows exploiting incorrectly configured access control security levels. This issue affects WP Event Solution from n/a through 4.1.25.

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. A crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. Someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. Someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.

The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input, leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.

The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.

The WP Dummy Content Generator plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WP Dummy Content Generator from n/a through 4.0.0.

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0 affecting the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the Department Search Endpoint component. Manipulation of the keyword argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used; the project was informed but has not responded yet.

A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected is the htmlspecialchars_decode function of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the Create Customer Endpoint component. Manipulation of the customer_form[remark] argument results in cross site scripting, and the attack can be initiated remotely. The exploit has been made public and could be used; the project has not responded to the issue report.

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values; the check fails and reports an error, and the default error handler halts the device.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0 affecting the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the Crm Endpoint component. Manipulation of the redirect_url argument leads to cross site scripting, and the attack may be performed remotely. The exploit has been disclosed publicly and may be used; the project was informed but has not responded yet.

A flaw has been found in feelec-yishu feelcrm-os 1.0.0 affecting an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the getMemberByGroups Endpoint component. Manipulation of the groups[] argument causes sql injection, and the attack is possible remotely. The exploit has been published and may be used; the project was informed but has not responded yet.