CVE Vulnerability Catalog

CWE-522 Insufficiently Protected Credentials vulnerability allows a local privileged attacker to bypass authentication and modify credentials, potentially leading to compromise of managed devices.

CWE-787 Out-of-bounds write vulnerability in IGSS Definition can cause data loss or potential arbitrary code execution when importing a malicious CGF file.

The Extra Checkout Options plugin for WordPress up to version 2.3.2 allows authenticated users with Subscriber-level access and above to upload PHP files. Missing authorization and nonce validation in the eco_save_settings() function enables modification of allowed file types, followed by PHP file upload via the frontend, leading to remote code execution.

GNU Bison allows arbitrary program execution during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for XML-to-HTML transformation via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). Running bison --html on an attacker-provided grammar enables execution of an arbitrary program with the privileges of the Bison process.

In the BFD library of GNU binutils, the DLX ELF backend's dlx_rtype_to_howto() function lacks bounds checking, allowing out-of-bounds write. A crafted ELF/DLX file can lead to arbitrary code execution.

The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.

The GTM4WP plugin for WordPress up to version 1.22.3 has a Stored XSS vulnerability via WooCommerce billing fields. An unauthenticated attacker can inject JavaScript in the billing first name during guest checkout.

SQL injection vulnerability in ERPNext and Frappe due to direct string interpolation in SQL queries. An authenticated low-privilege user can execute arbitrary SQL, bypass access controls, and extract sensitive data including admin password hash.

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The header_rewrite plugin in Apache Traffic Server can crash or corrupt memory during cookie operations and CIDR condition matching. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The regex_remap plugin in Apache Traffic Server overflows the stack and integers from substitution input. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Cripts framework of Apache Traffic Server has out-of-bounds writes, path traversal, and use-after-free errors. Affected versions: 10.0.0 through 10.1.3.

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.