CVE Vulnerability Catalog

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server from 2.4.60 through 2.4.68.

This CVE candidate has been rejected. Do not use this candidate number. All references and descriptions have been removed to prevent accidental usage.

Two Zephyr syscalls (smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb()) forwarded a caller-supplied struct smbus_callback *cb pointer into kernel-mode driver code without any memory validation. On builds with CONFIG_USERSPACE and an SMBus driver supporting SMBALERT or Host Notify, a user-mode thread could unregister a callback registered by a supervisor-mode component or trigger a kernel fault via a bogus pointer. The fix removes both syscall entry points.

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later.

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose aas or path query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

Broken Access Control vulnerability in WP Project Manager up to version 4.0.7 allows a subscriber to gain unauthorized access to administrative functions.

Missing Authorization vulnerability in Review Schema version 3.1.0 allows exploitation of incorrectly configured access control security levels.

Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels up to version 3.13.1 allows an attacker to access resources without authorization.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.