CVE Vulnerability Catalog

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file, or to the 'oratab' file itself, to execute code as root if an agent has the 'mk-oracle' plugin enabled.

The Tailored Tools plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability that allows forcing unintended actions on behalf of a logged-in user. This issue affects Tailored Tools versions up to and including 3.0.3.

In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.

The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.

BusyBox libarchive contains a symlink directory traversal vulnerability allowing remote attackers to create arbitrary files. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw results from lack of proper validation of a user-supplied path before use in file operations.

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.

In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.

The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.

Nuxt framework versions 3.13.0 through 4.6.2 contain a vulnerability where the server-island renderer serializes raw useHeadSafe entry input without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application passing attacker-controlled data to useHeadSafe in a .server.vue component or one rendered through NuxtIsland can render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. The issue is fixed in version 4.6.2.

In Nuxt prior to 4.6.2, pages are resolved case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively. A request differing only by letter case can render without the intended server rule, skipping redirects, headers, proxy, ssr: false, and noScripts. Applications setting router.options.sensitive: true in nuxt.config are not affected.

Nuxt, an open-source web development framework for Vue.js, from 3.11.0 until 3.21.4 and 4.4.4 compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters. This allows a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path, so appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data.

In stream-json from 2.0.0 until 3.7.0, FlexAssembler joins the full key stack on every container start, causing quadratic CPU consumption for deeply nested documents. The join occurs before rule matching, so the attacker need not know the schema; only consumers using string or regex path filters are affected.

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values, allowing injection of arbitrary HTML and JavaScript. The issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components, and can produce reflected or stored cross-site scripting under the application's origin.

H5P through 1.17.9 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels.

In Apache Pulsar, when package management is enabled, the Functions worker authorized requests to register or update functions, sources and sinks only against the namespace where the component was being registered, without checking whether the requesting user could access the package referenced by the package URL. The package was retrieved from the broker using the worker's own credentials, so the Packages Management Service permission check applied to the worker's identity rather than the requesting user's. An authenticated user could thereby obtain the contents of a package stored in another tenant's namespace without having the required permissions.

The Apache Pulsar broker did not check authorization for the GetSchema and GetOrCreateSchema binary protocol commands, verifying only that the client was authenticated. An authenticated client without permissions on the target topic could read a schema from another namespace or tenant, or register a new schema version, potentially causing schema incompatibility errors for legitimate producers and consumers. The issue affects deployments with authorization enabled in versions 2.2.0–4.0.13, 4.1.0–4.1.3, and 4.2.0–4.2.4.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.