CVE Vulnerability Catalog

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before rendering in the browser. Exploitation could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the crafted content.

Expression Language Injection vulnerability in the Apache Camel AWS2-s3 component (versions 4.8.0–4.18.4, 4.19.0–4.22.1). The S3 object name taken from the CamelAwsS3Key header is passed to the Simple language and evaluated as an expression, allowing anyone able to choose an object name in a consumed bucket to have arbitrary Simple expressions evaluated in the Camel process.

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. When token introspection is enabled (useTokenIntrospection=true), introspection results are cached by default and cache entries are not bounded by the token's exp claim. As a result, an expired token can still be accepted for up to introspectionCacheTtl (default 60 seconds) after its expiration.

A path traversal vulnerability in the Apache Camel Docling component allows the conversion output file to be written to any directory writable by the Camel process. The CamelDoclingOutputFilePath header value is passed without normalization or confinement to a base directory, letting an attacker influence the output location.

A path traversal vulnerability in the Apache Camel Docling component allows an absolute path supplied in the CamelDoclingCustomArguments header to bypass the validatePathSafety check, which only rejects relative traversal sequences such as ../. As a result, a party able to control these arguments can point the docling process at any directory accessible to the Camel process, outside the intended working directory. The issue affects versions 4.15.0–4.18.4 and 4.19.0–4.22.1 and is fixed in 4.23.0, 4.22.2, and 4.18.5.

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing; if another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall version 26.7.1_1 and earlier, allowing a low privileged attacker to execute JavaScript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Pleasanter fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

The Meow Apps AI Engine plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.6.

The VillaTheme DEPART plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects DEPART from n/a through 1.0.10.

A vulnerability in the Apache Camel CoAP component allows sensitive information disclosure in error responses. When the CoAP consumer fails to build its response after the route completes, the resulting exception is caught and its message — containing class names, file paths, host names, and connection details — is sent back to the CoAP client as the payload of a 5.00 Internal Server Error response.

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to version 1.24.0.3 in an unknown function of the Workshop Scenario Loader component. Manipulation leads to deserialization, and the attack can be performed remotely. Upgrading to version 1.24.0.4 fixes the issue.

benotes up to version 2.8.1 contains a Server-Side Request Forgery vulnerability in the getUrlInfo function of app/Http/Controllers/PostController.php, within the Bookmark Metadata Endpoint component. Manipulation of the url argument leads to server-side request forgery.

EasyImage up to version 2.8.7 contains a vulnerability in an unknown function of app/del.php involving improper privilege management. Manipulation of the hash argument can lead to privilege escalation.

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the OLE2 Parser component. The manipulation leads to heap-based buffer overflow, and the attack can be initiated remotely.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers. This allows unauthenticated users to make donations below a form's configured minimum or fixed amount.

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes. This allows unauthenticated attackers to mark arbitrary orders as paid, cancel arbitrary orders, and disclose order details including customer contact information.

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.