CVE Vulnerability Catalog

A use-after-free vulnerability was found in the SSSD (System Security Services Daemon) PAM component responsible for YubiKey authentication. The flaw is caused by improper memory pointer handling, which can lead to a crash. A local attacker could exploit this by manipulating smartcard or YubiKey contents.

Nokia MantaRay is affected by an Improper Access Control vulnerability due to insufficient authorization in the API. An authenticated attacker could exploit this to retrieve confidential information beyond their assigned privileges.

The decode-uri-component library through version 0.4.1 is vulnerable to denial of service (DoS). The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

The Fluent Booking WordPress plugin before version 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint. Users with at least the Calendar Manager role can retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

Multiple laser printers and MFPs implementing Ricoh Web Image Monitor are vulnerable to reflected cross-site scripting (XSS). An attacker can execute arbitrary scripts in the victim's browser by tricking them into clicking a crafted URL.

The Kali Forms WordPress plugin before 2.4.13 does not sanitize a form field's caption before outputting it as a column header on the admin form-entries screen. Users with Contributor-level access or above can inject JavaScript that executes in an administrator's session. A missing capability check in the post-duplication action allows the Contributor to publish the malicious form so an administrator renders it.

The Plugin for Google Analytics by IO technologies for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page (ga.php), allowing unauthenticated attackers to update the plugin's stored Google Analytics tracking ID option (io-ga-id) via a forged request, provided they can trick a site administrator into clicking a link.

The Editorial Rating – Product Review & Rating System plugin for WordPress up to version 4.0.5 is vulnerable to Stored Cross-Site Scripting via the 'Link URL' field due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts that execute when users access the affected page.

The Premium Addons for KingComposer plugin for WordPress up to version 1.1.1 is vulnerable to unauthorized modification and data loss. Missing authorization and capability checks in the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers allow unauthenticated attackers to create or delete custom widget areas, potentially causing widgets to silently lose registration and stop rendering.

The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.7.2 via the move_image_on_server function. This allows authenticated attackers with author-level access or above to write files with attacker-controlled content to arbitrary locations on the server.

A Time-of-check time-of-use (TOCTOU) race condition vulnerability has been discovered in Samsung Open Source Escargot. This flaw allows leveraging race conditions to compromise data integrity.

The Team Members – Multi Language Supported Team Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 8.7 inclusive. This is due to insufficient input sanitization and output escaping.

In Zephyr OS, the mcumgr_serial_process_frag() function calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and writing through the NULL pointer causes a system crash.

The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

The USB CDC-NCM driver in Zephyr RTOS ignores the return value of usbd_ep_enqueue(). When enqueue fails (e.g., during USB bus suspend), the function blocks on a semaphore that never signals, causing a permanent deadlock of the TX thread and halting network transmission until reboot.

An improper authorization vulnerability in Apache Tomcat causes security constraints for the default servlet to ignore any configured HTTP method or method omission. This affects Tomcat versions from 7.0.0 through 11.0.22.

A vulnerability in Apache Tomcat allows a replay attack against the EncryptionInterceptor in the cluster component. The issue stems from improper authentication, enabling an attacker to reuse intercepted data.

A basic XSS (Cross-Site Scripting) vulnerability was found in the number guess example application in Apache Tomcat. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code.

XSS vulnerability in the mdex library for Elixir allows an attacker to inject JavaScript code via improper validation of URL schemes in Markdown to Quill Delta processing. An attacker can supply a malicious link with javascript: scheme in Markdown text, which is copied verbatim to the Delta attribute and executed in the victim's browser when rendered to HTML.

A vulnerability in the mdex library (and mdex_native) allows a DoS attack by supplying a deeply nested Markdown document. Recursive conversion functions lack a maximum depth check, causing a C stack overflow and crashing the entire BEAM node.