CVE Vulnerability Catalog

The Gerador de Certificados – DevApps plugin for WordPress up to version 1.3.6 inclusive contains a vulnerability allowing arbitrary file uploads due to missing file type validation in the moveUploadedFile() function. Authenticated attackers with Administrator-level access or higher can upload malicious files to the server, potentially leading to remote code execution.

The ActivityPub WordPress plugin before version 8.0.2 does not properly filter displayed posts, allowing unauthenticated users to access drafts, scheduled, and pending posts.

MATCHA INVOICE version 2.6.6 and earlier allows an administrator to upload files with dangerous types, potentially creating arbitrary files on the server and executing arbitrary code.

W wersjach MATCHA INVOICE 2.6.6 i wcześniejszych występuje podatność na atak typu SQL Injection. W przypadku jej wykorzystania, użytkownik zalogowany do produktu może uzyskać dostęp do informacji przechowywanych w bazie danych lub je zmienić.

A stack-based buffer overflow vulnerability exists in ASDA-Soft.

A CSRF vulnerability in the Product Feed PRO for WooCommerce plugin (versions 13.4.6 to 13.5.2.1) allows unauthenticated attackers to trigger feed migration, clear cache, rewrite URLs, toggle filter settings, and delete feed posts by tricking an administrator into clicking a link.

When verifying a certificate chain with excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs with different case. This affects only otherwise trusted chains issued by a root CA.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled resource consumption. This leads to denial of service. This only affects TLS 1.3.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

During chain building, the amount of work is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Kompilator powinien rozpakowywać wskaźniki będące operandami operacji przenoszenia pamięci, jednak interfejs konwersji, który nie wykonuje żadnej operacji, uniemożliwił mu prawidłowe określenie, czy przenoszenia nie nakładają się. Może to prowadzić do uszkodzenia pamięci w czasie wykonywania programu.

A vulnerability in SWIG allows code smuggling and arbitrary code execution at build time when file names contain 'cgo' and are used with crafted payloads, due to a trust layer bypass.

IBM Tivoli Netcool Impact versions 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user.

IBM Langflow Desktop versions 1.6.0 through 1.8.2 have a vulnerability that allows an authenticated user to execute arbitrary code on the system. This is due to an insecure default setting that permits deserialization of untrusted data in the FAISS component.

Podatność w IBM Verify Identity Access Container oraz IBM Security Verify Access Container umożliwia atakującemu kontakt z wewnętrznymi punktami końcowymi uwierzytelniania, które są chronione przez Reverse Proxy. Dotyczy to wersji 11.0 do 11.0.2 oraz 10.0 do 10.0.9.1.

An out-of-bounds write in virtio PCI transport in Firecracker 1.13.0-1.14.3 and 1.15.0 on x86_64 and aarch64 allows a local guest user with root privileges to crash the VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation.

A vulnerability in IBM Verify Identity Access and IBM Security Verify Access allows a locally authenticated user to execute malicious scripts from outside its control sphere.

The CentralAuth extension of MediaWiki improperly removes sensitive information before storage or transfer, leading to resource leak exposure. The issue is fixed on the master branch and in versions 1.43, 1.44, and 1.45.

In the Botan C++ cryptography library version 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it returned true if any certificate in the store had a matching DN (and subject key identifier, if set) but did not check if the certificates were identical. In 3.11.0, path validation logic was extended assuming certificate_known only returns true for identical certificates. As a result, an end entity certificate with a DN matching a trusted root is accepted as a trusted root. This vulnerability is fixed in version 3.11.1.

In Flatpak prior to version 1.16.4, the ld.so caching mechanism removes outdated cache files without verifying that the app-controlled path is within the cache directory. This allows Flatpak apps to delete arbitrary files on the host.