CVE Vulnerability Catalog

The PLCnext Engineer communication interface on the device has an unauthenticated denial-of-service vulnerability. A remote attacker can interrupt access via the client application, requiring manual restart of the PLCnext service.

The Snowflake Python API (`snowflake.core`) before version 1.13.0 has insufficient input sanitization, allowing confused-deputy privilege escalation through path traversal and HTTP parameter pollution. An attacker controlling an identifier or object name in an application using snowflake.core can perform operations on parent resources or override constraints on swap, clone, or rename operations in a higher-privileged session.

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

The Events Manager WordPress plugin before 7.4.1 does not sanitize and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

The WP Photo Album Plus plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the server, including those outside the web root.

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers. Unauthenticated attackers can download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query. Authenticated users with a clinic staff-level role can perform SQL injection.

The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

Velociraptor allows scheduling new collections via VQL queries in notebooks. The COLLECT_CLIENT permission is required, but it is not enforced when the user can run a VQL query that resets the authorization provider. A user with the analyst role can launch new collections, which usually require the investigator role, leading to privilege escalation.

The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy, but then re-read the still-live user struct for subsequent decisions. A double-fetch/TOCTOU allows a cooperating thread to inflate msg->msg_iovlen, leading to out-of-bounds writes in the kernel heap. This can result in local privilege escalation or kernel denial of service.

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to and including 1.4.3. The plugin trusts the unverified email field from Spotify's /v1/me endpoint, allowing unauthenticated attackers to log in as any existing WordPress user, including administrators, and gain full administrative access.

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information, reading all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories.

A flaw was found in multicloud-operators-subscription. A privileged user (namespace administrator) can manipulate the Channel.Spec.SecretRef.Namespace field, causing the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.

In UEFI firmware, lack of verified boot for certain firmware volumes (FV) may allow arbitrary code execution.