CVE Vulnerability Catalog

The vulnerability in an application that opens PDF files causes JavaScript to use a damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

The vulnerability occurs when the application opens a PDF file, and JavaScript rewrites the document, modifying the page structure and invalidating page objects. Thumbnails still use these invalid objects, ultimately causing the application to crash.

Embedded JavaScript in a PDF file deleted pages, invalidating the object. The application attempted a write operation on invalid pop-up annotations, causing a crash.

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress up to version 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects. If a suitable gadget chain is present on the site, this can lead to remote code execution.

The Eventer plugin for WordPress is vulnerable to time-based SQL injection via the 'code' parameter in all versions up to and including 4.4.2 due to insufficient escaping and lack of proper SQL query preparation.

In Pupsman versions prior to 3.9.0, there is an incorrect default permissions issue. An attacker can place a malicious executable in the installation folder, leading to arbitrary code execution with SYSTEM privileges.

An uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

The DoLogin Security plugin for WordPress up to version 4.3 inclusive contains an authentication bypass vulnerability due to insufficient randomness. The `dologin\s::rrand()` function seeds the Mersenne Twister with a microsecond-based seed, limiting entropy to about 20 bits, and then generates a 32-character magic-link token deterministically. An unauthenticated attacker can brute-force the seed space (approximately 10^6 candidates) to reconstruct an active passwordless login token and authenticate as any user, including administrators, without a password.

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This allows authenticated attackers with Custom-level access and above to upload arbitrary files to the server, potentially leading to remote code execution.

The Backstage - Customizer Demo Access plugin for WordPress up to version 1.4.2 is vulnerable to privilege escalation. This is due to assigning the overly permissive `manage_options` capability to the `backstage_customizer_user` demo role, allowing unauthenticated attackers to exit the Customizer and modify WordPress options like `default_role`.

The 多说社会化评论框 plugin for WordPress up to version 1.2 contains a privilege escalation vulnerability. Missing capability and nonce checks on a web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature, allow unauthenticated attackers to update arbitrary WordPress options. Attackers can set the default role to administrator, enable registration, and then register an account with full admin privileges.

The Jssor Slider plugin for WordPress up to version 3.1.24 is vulnerable to Directory Traversal via the 'url' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers with subscriber-level access and above to execute code on the server.

In OpenSSH before version 10.4, a use-after-free vulnerability exists in the SSH client during key re-exchange when a server changes its host key. This issue affects only the client side.

In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.

A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.

A vulnerability in Coder allows injection of arbitrary SSH configuration into the user's ~/.ssh/config via unsanitized HostnameSuffix and SSHConfigOptions values supplied by the server. Exploitation requires control over the Coder server (malicious deployment, MITM attack, or admin access).