CVE Vulnerability Catalog

Aplikacje Mattermost Desktop w wersjach <=6.1, 6.0.1 oraz 5.4.13.0 nie zapobiegają ładowaniu nieprawidłowego URL w oknie pop-up, co pozwala złośliwemu właścicielowi serwera na wielokrotne awarie aplikacji poprzez wywołanie {{window.open('javascript:alert()');}}.

Wtyczki Mattermost w wersjach <=11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nieprawidłowo sprawdzają uprawnienia podczas przetwarzania poleceń w wtyczce Gitlab. To pozwala zwykłym użytkownikom na odinstalowanie instancji lub skonfigurowanie połączeń webhook za pomocą poleceń {{gitlab instance {option}}} lub {{/gitlab webhook {option}}}.

Wersje wtyczek Mattermost do 11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nie sprawdzają poprawnie ważnych przestrzeni nazw, co pozwala użytkownikom wtyczek na tworzenie subskrypcji do grup, które nie zostały zatwierdzone, poprzez tworzenie grup o tym samym prefiksie co grupa zatwierdzona.

Wersje wtyczek Mattermost do 11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nie mają odpowiednich kontroli na poziomie API dotyczących grup, do których użytkownik może tworzyć zgłoszenia lub dodawać komentarze. Umożliwia to użytkownikowi, będącemu członkiem wielu grup, tworzenie zgłoszeń w zablokowanej grupie za pomocą bezpośrednich żądań API.

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability allowing unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can use directory traversal in the download parameter in admin.php requests to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through user creation fields. Attackers can insert JavaScript payloads in the First Name, Last Name, and Email fields, which execute when viewing the User List page.

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability allowing authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files with embedded JavaScript, which execute when other authenticated users access the file.

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.

NewsLister contains an authenticated persistent cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through the title parameter in the news addition interface. Attackers can inject JavaScript payloads via the title field in the admin panel that execute when news items are viewed by other users.

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.

WordPress Plugin BuddyPress 6.2.0 contains a persistent cross-site scripting vulnerability allowing authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers that execute when administrators preview or view the affected page content.

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. Metric names were not checked for newlines, colons, or pipes, allowing additional metrics to be injected from untrusted sources.

The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.

Cockpit CMS up to version 2.14.0 contains a stored cross-site scripting vulnerability in the Set field type's Display template option. The template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization, allowing an attacker with content/:models/manage permission to inject arbitrary JavaScript.

The 'ws' WebSocket library for Node.js prior to 8.20.1 has a vulnerability that discloses uninitialized memory when closing a connection with a TypedArray as the reason argument.

Countermeasures for DPA within the SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. KSU keys using SYMCRYPTO will be impacted by this vulnerability.

A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

Hedera Guardian through version 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint. Unauthenticated attackers can retrieve sensitive user information including usernames, Hedera DIDs, system roles, and policy assignments.