CVE Vulnerability Catalog

The Post Grid plugin by Mamunur Rashid contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects The Post Grid from n/a through 7.9.2.

In WeGIA prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint through the nextPage parameter combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This vulnerability is fixed in 3.7.3.

In WeGIA versions prior to 3.7.3, html/login.php hashes the submitted password using PHP's hash() function with SHA-256 and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage; without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.

Ella Core, a 5G core designed for private networks, prior to 1.10.0 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.

Streamlink to narzędzie CLI, które przesyła strumienie wideo z różnych usług do odtwarzacza wideo. W wersjach przed 8.4.0, parsery HLS i DASH w Streamlink nie weryfikowały schematu URI segmentów i innych zasobów, co pozwalało na wczytanie lokalnych plików z nieautoryzowanych źródeł.

In free5GC prior to 4.2.2, the UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request when the supplied ueId does not exist in UESubsCollection. Although a 404 USER_NOT_FOUND response is set, execution continues and performs a type assertion on a nil interface, causing a panic and an HTTP 500 response.

In free5GC prior to 4.2.2, the UDR nudr-dr DELETE handler contains a nil-pointer dereference reachable from a single authenticated request after a preparatory EE-subscription create. It causes a panic and HTTP 500, and the endpoint remains repeatedly panicable.

free5GC, an open-source 5G core network implementation, prior to 4.2.2 has an unsynchronized write on the global Subscriptions map in the BSF PUT /nbsf-management/v1/subscriptions/{subId} handler. Under concurrent authenticated PUT load, one goroutine can read while another writes the map, causing the Go runtime to abort the process and take down the entire BSF SBI surface. This is fixed in 4.2.2.

In free5GC prior to 4.2.2, the PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request where ascReqData.suppFeat == "1" and medComponents entries supply an afAppId but no AfRoutReq. It causes a nil pointer dereference and HTTP 500.

Free5GC to otwartoźródłowa implementacja rdzenia sieci 5G. W wersjach przed 4.2.2, AMF w Free5GC nie weryfikuje zdolności zabezpieczeń UE otrzymywanych w wiadomościach NGAP PathSwitchRequest, co pozwala złośliwemu gNB na nadpisanie tych wartości, prowadząc do odmowy usługi przenoszenia dla dotkniętych UE.

A stored cross-site scripting (XSS) vulnerability was found in the /admin/config-module.php component of the simplephp project (commit 5184cff). An attacker can inject a malicious JavaScript payload that will be executed in administrators' browsers.

An authentication bypass vulnerability was discovered in OpenRapid RapidCMS v1.3.1 within the /template/default/menu.php component. The flaw is exploited by injecting a crafted SQL payload into the 'name' cookie parameter.

W GPAC MP4Box występuje dereferencja wskaźnika NULL podczas analizy niektórych skróconych plików MP4. Nieznany lub nieprawidłowy wpis stsd może prowadzić do brakujących pól deskryptora, co skutkuje wywołaniem strlen() na wskaźniku NULL i powoduje awarię.

SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although the app integrates Android's biometric mechanisms, the lock is implemented with a custom overlay that fails to consistently enforce authentication. By navigating cascading interface flows, an attacker can exit the lock interface without re-authentication and access protected apps, leading to information disclosure and privilege escalation.

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.

The Facebook for WooCommerce plugin contains an Open Redirect vulnerability that enables phishing attacks. The issue affects versions from n/a through 3.7.0.

The Prasad Kirpekar WP Meta and Date Remover plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.3.6.

The DearFlip plugin by DearHive contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects DearFlip from n/a through 2.4.27.

The Adminimize plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.11.11.

The Advanced Custom Fields: Font Awesome Field plugin (through 5.0.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be stored and executed in a user's browser.