CVE Vulnerability Catalog

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit. A deeply nested JSON document of about 20 KB causes a raw java.lang.StackOverflowError instead of a JSONException, failing the parsing thread.

The SureDash plugin by Brainstorm Force is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.12.2.

The SureDash plugin by Brainstorm Force, versions up to 1.12.2, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, leading to heap memory corruption and a crash of the web server process.

The WordPress plugin Elementor Addon Elements up to version 1.14.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious input can be stored and executed in a user's browser.

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PowerPack Addons for Elementor from n/a through 3.1.0.

The WordPress Metform plugin (through version 4.3.2) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.

The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The H5P plugin up to version 1.17.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User input is not properly sanitized before being stored.

Missing Authorization vulnerability in WP Chill Strong Testimonials through 3.3.14 allows Exploiting Incorrectly Configured Access Control Security Levels. The flaw enables unauthorized access to functionality or data governed by access control.

The Falcon – WordPress Optimizations & Tweaks plugin by eLightUp, versions up to 2.12.0, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The MarketKing plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects MarketKing versions up to and including 2.1.72.

An out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (versions 4.1.0 to 5.3.0) occurs because the input size check did not include the preamble, allowing a truncated sketch to cause a read past the end. Additionally, the table size is computed in 32-bit arithmetic, which can wrap to zero, leading to an empty table and subsequent out-of-bounds reads and writes, corrupting heap memory.

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

The WordPress plugin Photo Engine (Media Organizer & Lightroom) before version 6.5.8 does not verify that a user is authorized to act on the targeted media attachment. Authenticated users with the author role and above can delete arbitrary attachments, including those uploaded by other users and administrators.

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state.

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all review fields submitted through its public review form, which is available to unauthenticated visitors. This allows execution of arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.