CVE Vulnerability Catalog

Cross Site Scripting (XSS) vulnerability in CF7 Views – Complete Entry Management for Contact Form 7 versions up to 3.2.5. An attacker with contributor privileges can inject malicious script.

Unauthenticated Denial of Service attack in Two Factor versions up to 0.16.0. An attacker can cause service unavailability without authentication.

The If-So Dynamic Content Personalization WordPress plugin through 1.10.1 is vulnerable to Reflected XSS due to improper neutralization of input during web page generation.

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages.

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

Vulnerability in Cato Windows SDP Client before version 6.12.6 allows arbitrary file disclosure. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

SQL injection vulnerability in OS4ED openSIS-Classic up to 9.3. The function DBQuery_assignment in file modules/grades/Assignments.php (component Assignment Management Endpoint) allows manipulation of the argument Tables, enabling remote attack. Exploit is publicly available.

Claude Code selected an API key stored by Claude Code (e.g., from an earlier /login or written to its configuration) ahead of the user's valid Claude Enterprise or Team sign-in when fetching server-managed settings. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy or kept applying a stale copy, while continuing to operate as the organization's account. This required local access to a device with such a stored API key. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work from 2.1.38. Users on auto-update have received the fix; manual update to 2.1.260 or later is advised.

The WPMobile.App (wpappninja) plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 11.83. This allows retrieving embedded sensitive data.

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availability.

In Grafana, a user with the Editor role can set file-provisioning metadata (grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

In Grafana, an authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user with tag editor permission could craft a request that includes additional model data (such as User or Organisation records), enabling modification or creation of privileged accounts and escalation to site administrator.

In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.

Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".

A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.