CVE Vulnerability Catalog

There is a memory leak in NI grpc-device version 2.17.0 and prior in the BeginSidebandStream function, which may lead to denial of service due to memory exhaustion.

There is an unchecked enum cast vulnerability in NI grpc-device version 2.17.0 and prior in the BeginSidebandStream function. This may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service.

There is an authentication bypass vulnerability in Apache APISIX due to a capture-replay attack. An attacker can exploit certain configurations in hmac-auth to reuse a token indefinitely, bypassing its expiry.

The 'Open Redirect' vulnerability in Apache APISIX allows redirecting users to untrusted sites, potentially leading to phishing and credential theft. This affects versions from 3.0.0 to 3.16.0.

A vulnerability in Apache APISIX related to the use of less trusted sources allows attackers to exploit the wolf-rbac plugin under default configuration, potentially leading to log pollution and violations of IP-based access control rules.

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling.

Cloudflare Quiche is affected by two use-after-free vulnerabilities in the connection ID iterator FFI functions. These functions return a pointer to 'ConnectionId' that is dropped at the end of their scope.

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.

The AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. This allows an authenticated AIL user to craft malicious item identifiers that may lead to unauthorized disclosure of local files.

The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 0.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing unauthenticated attackers to view customers' subscription data.

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint that allows all incoming requests without any authentication checks.

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.9.1. This allows authenticated attackers with subscriber-level access and above to extract the raw title, content, excerpt, and password of any private, draft, or password-protected post.

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file read in versions 1.7.1058 through 1.7.1059. The issue arises from the wpr_get_csv_handle() function, which does not validate the URL and allows attackers to read the contents of any file accessible to the PHP process.

The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and including 2.0.4. This is due to insufficient path sanitization in the render_logs_ui() function, which accepts a base64-encoded file name and concatenates it directly with the plugin's log directory path.

In libexpat before version 2.8.2, there is a heap-based buffer overflow in the doProlog function in xmlparse.c. This issue arises from mishandling of scaffold backing array reallocation when there is data-structure sharing across parsers.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. This can lead to a use-after-free situation.

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.4.6. The issue arises from the lack of validation of the user-supplied URL in the demo_download_and_unzip() function, allowing requests to be sent to internal network resources.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via custom booking field labels in all versions up to and including 1.4.4 due to insufficient input sanitization and output escaping.

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken, leading to TypeError crashes.