CVE Vulnerability Catalog

In Apache NimBLE, there is a classic buffer overflow vulnerability in the HCI socket transport. The system did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow.

A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 allows an attacker to execute arbitrary JavaScript via a maliciously crafted URL, leading to administrative account takeover. This affects Looker-hosted and Self-hosted instances; Looker-hosted instances are already patched, while Self-hosted instances require an upgrade.

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL matches the configured allowlist or regex. An attacker with MITM position can provide a CA-signed certificate for a matching hostname, intercept the CAS exchange, capture the TGT, and obtain Service Tickets on behalf of the victim. Confirmed in versions 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client), but may affect other versions.

A local privilege escalation vulnerability potentially allows an attacker to execute arbitrary code as a privileged user.

A local privilege escalation vulnerability that potentially allows an attacker to write an arbitrary file with fully controlled content as a privileged user.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges. The administrator role is protected, but attackers can also enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments.

Kernel software running inside a Guest VM can send improper commands to the GPU firmware, causing out-of-bounds memory writes outside the guest's virtualized GPU memory.

Kernel software running inside a Guest VM can send improper commands to the GPU firmware, triggering out-of-bounds memory accesses. This can be used for privilege escalation escaping virtualization boundaries.

Software run by a non-privileged user can issue improper GPU system calls to manipulate the lifetimes of synchronization objects in the kernel, leading to read/write use-after-free (UAF) conditions.

The GeoVision GV-IP Device Utility desktop application is vulnerable to DLL hijacking. It loads DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library.

The WowOptin: Next-Gen Popup Maker WordPress plugin before version 1.4.38 lacks proper authorization on a REST endpoint, allowing unauthenticated users to disable all opt-in forms and insert new template-based opt-in rows into the database.

In Rapid7 InsightVM, Nexpose, and Insight Agent, discovered executables are executed during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent).

The CAFEHAUS API WordPress plugin up to version 1.0.0 lacks authentication or authorization when updating user passwords. An unauthenticated attacker can set the password of any user, including administrators, and fully take over their accounts.

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before version 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.

Multiple security vulnerabilities in Snowflake libsnowflakeclient prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution. A related out-of-bounds write could allow memory corruption. Improper validation of connection parameters could redirect authentication requests to an attacker-controlled endpoint.

In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.

In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.

In OpenStack Ironic Python Agent through version 11.6.0, a project-scoped user with the manager role can achieve remote code execution via a maliciously crafted configuration. The ntp_server value is passed to a shell without sanitization.

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options.