CVE Vulnerability Catalog

In 389 Directory Server, the dereference control plugin does not check for allocation failure before using a BER structure. An unauthenticated remote attacker can crash the LDAP server when the system is under memory pressure.

389 Directory Server contains a vulnerability in the ldap_utf8prev() function that reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.

389 Directory Server contains a type confusion vulnerability in the SSO token extended operation handler that causes partial stack address information to be disclosed in LDAP responses to authenticated users.

In the Linux kernel, a patch for hugetlbfs was reverted because it incorrectly handled VMA lock allocation at the mmap_prepare stage, potentially causing a lock leak. The revert restores previous behavior to allow redesign.

WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.

TYPO3 CMS has a vulnerability in the cache frontend (VariableFrontend) and persistent key-value store (Registry) where PHP payloads are deserialized without integrity validation or class restrictions. An attacker with write access to the backend (e.g., SQL database) can inject a crafted payload leading to remote code execution.

Authenticated backend users could retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Backend users could insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, allowing them to gather information about records and files they were not authorized to view. This affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Backend users could move records to a different page without having edit permissions on the source page. This affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Backend users with access to the Recycler module could restore soft-deleted records on pages or for tables they were not authorized to modify. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Editors with access to create or modify page content could include HTML markup in page titles stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

The GeneralUtility::sanitizeLocalUrl function in TYPO3 CMS incorrectly validates URLs, allowing open redirect attacks. After passing sanitization, the URL can redirect users to external sites. This affects versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when imported using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

The User Frontend plugin for WordPress up to version 4.3.2 contains a vulnerability allowing unauthorized modification of data due to a missing capability check in the user_subscription_cancel() function. Authenticated attackers with Subscriber-level access or higher can cancel any user's subscription pack, including administrators.

A vulnerability in SINEC INS (all versions before V1.0 SP2 Update 6) allows path traversal via the `GET /api/sftp/uploadFiles` endpoint due to improper sanitization of path input. This enables access to unauthorized file system locations.

A vulnerability in SIPROTEC 5 devices allows authenticated users to upload arbitrary files via the DIGSI 5 protocol. This could lead to malicious configuration files being uploaded, causing denial of service and potentially enabling code execution.

The Prime Elementor Addons plugin for WordPress (versions up to and including 1.3.3) is vulnerable to Stored Cross-Site Scripting via Widget HTML Tag Settings due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary scripts that execute whenever a user accesses an injected page. The exploit works even without the unfiltered_html capability because the payload (e.g., 'img src=x onerror=alert(document.domain)') contains no angle brackets and passes through Elementor's wp_kses_post() filter unchanged.

The MailerPress plugin for WordPress up to version 2.0.4 is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. The public campaign preview endpoint (/mp-email/{id}-slug/) is not affected due to a Content-Security-Policy header blocking inline scripts; exploitation is limited to the admin dashboard preview.

The Slider Revolution plugin for WordPress versions 7.0 to 7.0.10 allows sensitive information disclosure. Authenticated attackers with Subscriber-level access can read server files (e.g., .sql, .log, .json) by copying them to a publicly accessible directory.

The certificate revocation check in the CycloneCrypto cryptographic wrapper of the S2OPC library only considers the first matching CRL, ignoring other valid CRLs of the same CA. This could allow an OPC UA client and server to connect using a revoked certificate.