CVE Vulnerability Catalog

The WPB Floating Menu & Categories for WordPress plugin up to version 1.0.8 has a Stored Cross-Site Scripting vulnerability in the 'Icon CSS Class' category field. Authenticated attackers with Editor-level access or above can inject arbitrary scripts that execute when users view the page.

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

A heap buffer overflow vulnerability has been found in the libsolv library when processing a specially crafted .solv file with negative size values in the repo_add_solv function. This leads to undersized memory allocation and out-of-bounds write, which can be exploited for a DoS attack.

In libsolv, a stack-based buffer overflow vulnerability exists in the Debian metadata parser when processing specially crafted Debian repository metadata. An attacker can provide malicious SHA384 or SHA512 checksum tags, leading to memory corruption and denial of service (DoS).

In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.

In the nimiq-blockchain library (versions 1.3.0 and prior), network discovery accepts signed PeerContact updates from untrusted peers and stores them in the contact book, potentially causing an address book crash. An attacker can send a contact with an empty address list, causing a panic when accessing the address book.

Mantis Bug Tracker (MantisBT) up to version 2.28.1 is vulnerable to HTML and JavaScript injection in a textarea custom field on the Update Issue page. An authenticated attacker with low privileges can inject code that executes in the administrator's browser, leading to session theft and account takeover.

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

Google Chrome prior to version 148.0.7778.179 has insufficient validation of untrusted input in the Input component. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.

In Google Chrome on Mac prior to 148.0.7778.179, an out-of-bounds read in GPU allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a Chromium security severity of High.

Insufficient policy enforcement in Service Worker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Google Chrome on Windows prior to version 148.0.7778.179 has an inappropriate UI implementation allowing a remote attacker to perform UI spoofing via a crafted HTML page.

TeleJSON prior to 6.0.0 contains a DOM-based XSS vulnerability in the parse() function. Attackers can deliver a crafted JSON with a malicious _constructor-name_ value, passed unsanitized to new Function(), enabling arbitrary JavaScript execution, e.g., via postMessage in cross-frame contexts.

Trilium Notes version 0.102.1 and prior contain a critical vulnerability allowing unauthenticated remote code execution (RCE). Lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API allows an attacker to execute arbitrary Node.js code on the server by tricking an authenticated user into viewing a malicious SVG attachment.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim's browser when submitted.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in routes_nm.php, where the ticket_id parameter is passed unsanitized into the VALUE attribute of a hidden input field. An authenticated attacker can inject JavaScript via a crafted URL.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.