CVE Vulnerability Catalog

The Super Socializer plugin for WordPress up to version 7.14.5 is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link.

The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symp_arfe_replace_content() function, which uses str_replace() to substitute raw ACF field values (retrieved via get_field()) directly into Elementor-rendered HTML without any escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability in OpenSSH before version 10.4 causes the sshd server to not always enforce the minimum authentication delay. This could allow an attacker to perform login attempts more quickly.

In OpenSSH before version 10.4, the DisableForwarding=yes option did not override PermitTunnel=yes, allowing SSH tunneling despite forwarding being disabled.

In OpenSSH before version 10.4, an undocumented security-relevant behavior was found: the GSSAPIStrictAcceptorCheck parameter has no value when the server is in a Windows Active Directory environment.

A vulnerability in the internal-sftp server in sshd in OpenSSH before version 10.4 causes only the first 9 command-line arguments to be recognized. This can be significant if a later argument would have ensured the intended security properties of an SFTP connection.

A vulnerability in the scp tool in OpenSSH before version 10.4 may place a file in the parent directory of the intended directory when copying between two remote destinations.

A vulnerability in the SFTP client in OpenSSH before version 10.4 allows an attacker-controlled server to write downloaded files outside the intended target directory when using the "sftp server:/path ." command.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the subdomain-based workspace app proxy allowed bypassing the same-owner CORS check. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without verifying the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component used `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML`, causing HTML embedded in agent logs to be rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint only checked `ActionRead` on the workspace, missing an `ActionUpdate` check before triggering a destructive rebuild. An attacker with low privileges and workspace access could exploit this for unauthorized rebuilds.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.

A vulnerability in Coder allows an attacker to redirect traffic from the workspace app proxy to an arbitrary host via the X-Forwarded-Host header. The issue occurs when subdomain app routing (wildcard hostname) is enabled, a victim visits the attacker's shared app, and the upstream proxy does not strip this header.

A vulnerability in Coder allows an attacker to send a DataUpload request with an inflated FileSize value, causing excessive memory allocation and potential resource exhaustion. Affected versions are 2.24.0 through 2.29.6, 2.32.6, 2.33.7, and 2.34.1.

A vulnerability in Coder allows a denial-of-service (DoS) attack by uploading a crafted ZIP archive that, when converted to TAR in memory, has no aggregate limit on decompressed output. Exploitation requires authentication and file-upload access.

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates.

A NULL pointer dereference vulnerability exists in the smooth_parse_stream_index() function in src/media_tools/mpd.c of GPAC. The issue is fixed in commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.

An authenticated stored XSS vulnerability was found in LiquidFiles v4.2.7 in the Upload File Shares API. An attacker can inject malicious JavaScript or HTML into the Name parameter, which will be executed in other users' browsers.

A vulnerability in Anki prior to 25.09.4 allows malicious card packages with embedded iframes to access the internal localhost API, enabling reading of arbitrary files accessible to the Anki process and exfiltrating them over the network.