CVE Vulnerability Catalog

Spring WebFlux applications using the Kotlin Router DSL may be vulnerable to a security bypass. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Spring MVC applications accepting user-supplied values in cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript injection, leading to XSS.

Spring MVC or Spring WebFlux applications with a mapping for "/**" where the view name is not explicitly specified allow an attacker to craft a 302 redirect to an arbitrary external host via the redirect: prefix. Affects Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. The vulnerability affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

A WebFlux application with a compromised subdomain (e.g., via XSS) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable, which may be exploitable in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This requires the HTTP client to be explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0-1.0.51, 1.1.0-1.1.35, 1.2.0-1.2.17, and 1.3.0-1.3.5.

In Spring Retry versions 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4, a DoS vulnerability exists. An attacker can send a large number of unique failing requests, exhausting the application-wide stateful retry cache. Once full, all subsequent retries and circuit breakers fail permanently.

Tmux up to version 3.6a contains a use-after-free vulnerability in the image_free function in image.c. The attack requires local access and is difficult to exploit. An exploit has been publicly disclosed. The issue is fixed in version 3.7-rc.

The Product Filter Widget for Elementor plugin for WordPress up to version 1.0.6 is vulnerable to Reflected Cross-Site Scripting via the 'args[filterFormArray]' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts. Exploitation requires tricking a victim into clicking a link or CSRF-style form auto-submission to admin-ajax.php.

The jQuery Hover Footnotes plugin for WordPress up to version 1.4 is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier syntax. Authenticated attackers with author-level access can inject scripts that execute when users view the page.

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.4. Missing nonce validation on the jqFootnotes_options_subpanel function allows unauthenticated attackers to change plugin settings. Because option values like jqfoot_anchor_open are echoed unescaped, CSRF can be chained into persistent XSS affecting all visitors.

The TinyMCE shortcode Addon plugin for WordPress up to version 1.0.0 is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Enable Media Replace plugin for WordPress up to version 4.1.8 is vulnerable to Stored XSS via the 'location_dir' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or higher can inject arbitrary scripts.

Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.

A least privilege violation was discovered in the vsftpd component of TOTOLINK EX200 router version 4.0.3c.7646. Manipulation of the /etc/vsftpd.conf file allows remote exploitation. A public exploit is available.

Dolibarr ERP CRM up to version 23.0.2 has a vulnerability in the Legacy Filemanager component in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. An unknown function leads to improper authorization. The attack can be performed remotely, and the exploit is publicly available. A patch is available in version 23.0.3.

Stored XSS vulnerability in the Accordions plugin for WordPress, in the Accordion body field. Insufficient input sanitization and output escaping allow authenticated attackers with Custom-level access or higher to inject arbitrary scripts that execute when a user visits the page.