CVE Vulnerability Catalog

OpenAM before 16.1.3 contains a server-side request forgery vulnerability. Attackers able to register or modify OAuth 2.0 clients can make OpenAM fetch internal resources via an unvalidated jwks_uri. They can trigger unauthenticated fetches to probe internal hosts, metadata endpoints or local files, or exhaust request threads for DoS.

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly 'code'. Codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.

In Linux Mint Xreader up to 4.6.9, the function g_file_get_child in shell/ev-window.c (PDF Attachment Saving Handler) is vulnerable to path traversal via manipulation of the attachment argument. The attack can be performed remotely and the exploit has been publicly disclosed.

In Bouncy Castle for Java before 1.86 (and LTS before 2.73.13), the legacy PBES1 and PKCS#12 PBE families used an unbounded iteration count from untrusted input, allowing a small input to dictate arbitrary work. The fix rejects negative or over-limit counts (default 10,000,000) via the org.bouncycastle.pbe.max_iteration_count property.

In Bouncy Castle for Java before 1.86, the HQC implementation leaked secret-derived data through two side channels: GF(2^8) arithmetic used lookup tables indexed by field elements, and the fixed-weight support sampler stopped scanning on collision and stored positions at a secret index. An attacker observing cache behavior or decapsulation timing can recover information about the HQC private key.

The Twenty20 Image Before-After plugin for WordPress in all versions up to and including 2.0.5 is vulnerable to Stored Cross-Site Scripting via the 'offset' shortcode attribute due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages.

In Linux Mint Xreader up to 4.6.5, the function setup_document_content_list/g_strdup_printf in backend/epub/epub-document.c (EPUB File Handler) is vulnerable to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. Upgrading to version 4.6.6 fixes the issue.

The Burst Statistics plugin for WordPress in all versions up to and including 3.7.1 is vulnerable to Improper Authentication leading to Account Persistence. The maybe_load_shared_dashboard() handler issues a genuine WordPress session cookie for the burst_statistics_viewer account to any visitor with a valid share token, and the plugin does not restrict the core password update endpoint or filter the edit_user capability, allowing an unauthenticated attacker to set an attacker-chosen password and permanently take over that account.

The WPFront Notification Bar plugin for WordPress in versions up to and including 3.5.1 is vulnerable to Reflected Cross-Site Scripting. The debug-log output path (write_debug_logs) reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping.

The Photo Gallery by 10Web plugin for WordPress in versions up to and including 1.8.46 is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter due to insufficient input sanitization and output escaping. The editimage_bwg AJAX action performs a capability check but no nonce verification, so the payload can be delivered via a crafted GET request without a CSRF token.

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress in versions up to and including 3.5.3 is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes due to insufficient input sanitization and output escaping.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress in versions up to and including 3.0.19 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. An unauthenticated attacker can read, create, update, clone, and delete email notification flows, including overwriting default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content.