CVE Vulnerability Catalog

A vulnerability in UniFi OS is caused by a misconfigured CORS policy, allowing an attacker to lure an authenticated user to a malicious page and trigger actions in the system using that user's session.

A vulnerability in the UniFi Protect Application allows an attacker with network access, under certain conditions, to bypass authentication in UniFi Protect Cameras due to improper initialization.

A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.

An Improper Access Control vulnerability in UniFi Protect Application allows a network-accessible attacker to bypass authentication in certain API endpoints.

A Path Traversal vulnerability in self-hosted instances of UniFi Network Application allows an attacker with network access and high privileges to escalate write permissions on the host device.

A vulnerability in UniFi Network Application allows an attacker with network access to execute a Denial of Service (DoS) attack through improper input validation.

An SQL Injection vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the affected device or instance.

A Path Traversal vulnerability in devices running UniFi OS allows an attacker with network access to bypass authentication. The flaw affects specific UniFi OS devices or instances.

An SSRF vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the device or instance.

In the Linux kernel, a vulnerability exists in the Bluetooth L2CAP stack. The cleanup_listen() function closes channels directly, which can lead to lock inversion. The fix uses a channel timer to close channels asynchronously, ensuring correct lock ordering and preventing potential deadlocks.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth stack. The issue occurs in l2cap_sock_cleanup_listen() when closing a listening socket concurrently with an HCI disconnect, leading to l2cap_conn_del() freeing the child socket structure that is later used by cleanup_listen().

An improper validation vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.

The vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to access privileged driver functions through a Minifilter communication port that lacks proper access restrictions.

luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. The backend travelmate service (running as root) reads the raw UCI 'script' and 'script_args' values and executes the configured path when the captive-portal auto-login branch (f_check() in travelmate-functions.sh) is reached; an attacker with delegated write permissions can set script to /bin/sh and script_args to attacker-controlled arguments, resulting in arbitrary command execution as root.

The WPIDE – File Manager & Code Editor plugin version 3.5.6 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions in the context of the site administrator.

The WP EasyCart plugin for WordPress versions 5.9.0 and earlier contains a SQL injection vulnerability via the 'contributor' attribute. This allows an attacker to manipulate database queries.

The SEOWP plugin version 3.12.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unintended actions without their knowledge.

Cross-Site Request Forgery (CSRF) vulnerability in ProfileGrid by Metagauss (profilegrid-user-profiles-groups-and-communities) allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue affects versions from n/a through 6.0.0.2.

The Permalink Manager for WooCommerce plugin version 1.0.8.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.

The pCloud WP Backup plugin version 2.0.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unintended actions in the WordPress admin panel.