CVE Vulnerability Catalog

Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.

Double-free vulnerability in FreeRDP before version 3.28.0 (3.x through 3.27.1) in freerdp_client_rdp_file_apply_to_settings() when parsing the selectedmonitors field of a .rdp file. An attacker can convince a victim to open a crafted .rdp file with oversized monitor tokens, causing a double-free and potentially code execution.

Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.

Denial of service vulnerability in SurrealDB before version 3.1.0, in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

Vulnerability in SurrealDB before 3.1.5 in the DEFINE ANALYZER mapper filter allows arbitrary file read. Users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying paths in the filter and retrieving content via error messages when SURREAL_FILE_ALLOWLIST is empty or unconfigured.

Vulnerability in SurrealDB before version 3.2.0 allows authenticated users to access custom API endpoints in other namespaces/databases, potentially leading to reading sensitive data or unauthorized operations.

In _connect.BRAIN prior to version 5.06, the LogPathConfig.exe application is executed during setup, deleting existing permissions on %ProgramData% and replacing them with full control for the Everyone group, instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with version 5.06, the setup no longer runs this tool.

In BRAIN2 prior to version 3.09, the LogPathConfig.exe application is executed during setup, granting the Everyone group full control over %ProgramData% instead of restricting access to %ProgramData%\Bizerba\BRAIN2\. Starting with version 3.09, the setup no longer runs this tool, but the optional Bizerba ScriptService still executes it. ScriptService is deprecated and will not be included from version 3.11.

Authenticated OS command injection vulnerability in the system_certificates view, exploitable by a high-privileged remote attacker. Improper neutralization of special elements leads to total loss of confidentiality, availability, and integrity.

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. It silently falls back to a built-in rand-derived session id, which has low entropy and is easily guessed. Predictable session ids could allow an attacker to gain access to systems.

The Tag Groups WordPress plugin before version 2.2.0 improperly escapes one of its AJAX parameters before reflecting it in the response body served with an HTML content type. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.

A vulnerability in the Crypt::Password library for Perl (versions up to 0.28) allows timing attacks. The check_password method uses the eq operator, enabling attackers to guess the hash based on response time discrepancies.

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before version 1.4.1 does not enforce rate limiting or account lockout for passwordless email OTP verification, and stores short numeric codes in plaintext. An unauthenticated attacker who knows a registered email address can brute-force the code and log in as that user, including an administrator, leading to full site takeover.

The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

The SlimStat Analytics WordPress plugin before version 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator viewing the reports. Exploitation requires the plugin to be configured with the Cloudflare geolocation provider.

The Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins before version 7.34.0 do not sanitize and escape a request parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. This leads to an unauthenticated SQL injection vulnerability allowing attackers to extract sensitive data from the database.