CVE Vulnerability Catalog

Improper validation of specified quantity in input, allocation of resources without limits or throttling, and excessive iteration vulnerability exists in Apache Thrift PHP bindings. This issue affects Apache Thrift versions before 0.25.0.

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer, and for large frames it also reads past the end of the transform buffer.

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device.

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow.

Improper handling of length parameter inconsistency, uncaught exception, inefficient algorithmic complexity, memory allocation with excessive size value, and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift versions before 0.25.0.

An uncontrolled recursion vulnerability exists in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift versions before 0.25.0.

The c_glib bindings of Apache Thrift are vulnerable to use of uninitialized resource and return of wrong status code. This issue affects Apache Thrift before 0.25.0.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizemployees/update' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomOrigen' parameter in the '/es/origins/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

A SQL injection vulnerability was discovered in itsourcecode Online Admission System 1.0 in the confirm.php file. Manipulation of the ID argument allows remote attacks. The exploit has been publicly released.

The WP Statistics plugin for WordPress up to version 14.16.14 is vulnerable to Reflected Cross-Site Scripting via the REQUEST_URI query parameter key. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts.

The Repasat application has a Cross-Site Scripting vulnerability in the nomCompetidor parameter at the /es/competitors/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

Improper handling of exceptional conditions, allocation of resources without limits or throttling, and uncaught exception vulnerability exists in Apache Thrift Java bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling and improper handling of length parameter inconsistency vulnerability exists in Apache Thrift Lua bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python bindings. This issue affects Apache Thrift versions before 0.25.0.

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts.

The Download Manager plugin (up to version 3.3.71) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

The Advanced Ads plugin (up to version 2.0.26) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache.