CVE Vulnerability Catalog

Dell PowerFlex Manager version 4.6.2 and below has an insecure storage of sensitive information vulnerability. An unauthenticated attacker with local access can gain unauthorized access to sensitive data.

Dell PowerFlex Manager versions up to 4.6.2 have an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could tamper with information.

Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could exploit this to redirect a targeted application user to arbitrary web URLs.

XXE vulnerability in the WS-Transfer module in Apache CXF due to insecure XML parser configuration. An attacker can inject malicious XML entities.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, allowing authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints, allowing an attacker to cause a denial of service via crafted oversized HTTP requests.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers, allowing an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications, allowing an authenticated user to crash the server by timing the creation of a persistent notification message between the server deleting existing persistent notifications and archiving the channel.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, allowing an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.

STER software uses a weak password encoding algorithm, allowing the password value to be guessed after analyzing how known passwords are encoded. The issue was fixed in version 9.5.

The Vedrixa Forms plugin for WordPress up to version 1.1.1 fails to properly verify user permissions, allowing authenticated attackers with subscriber-level access to overwrite form structures by adding, removing, or altering fields.

The MotoPress Hotel Booking plugin for WordPress up to version 6.0.1 is vulnerable to authorization bypass. Unauthenticated attackers can overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce is output in the HTML source of every public page, so any visitor can obtain a valid nonce and perform the action without an account.

TeamViewer DEX Platform (On-Premises) prior to version 9.2 has a broken access control vulnerability. Some backend API endpoints do not enforce authorization correctly, allowing an authenticated low-privileged user to perform actions and access resources intended for higher-privileged roles.

The FluentCRM plugin for WordPress up to version 2.9.87 is vulnerable to blind SSRF via the 'SubscribeURL' parameter. Unauthenticated attackers can make requests to arbitrary locations from the application, allowing them to query and modify internal services. Exploitation requires that the SES bounce handling key has never been stored (default configuration).

The Slider by Soliloquy – Responsive Image Slider for WordPress plugin up to version 2.8.1 is vulnerable to sensitive information exposure via map_meta_cap. Authenticated attackers with subscriber-level access can extract draft slider metadata including unpublished media URLs, captions, and slider configuration.

The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3 due to missing or incorrect nonce validation on the save_widget_context_settings function. This allows unauthenticated attackers to modify widget visibility context settings via a forged POST request to /wp-admin/widgets.php, provided they can trick a site administrator into performing an action such as clicking a link.

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes via crafted PTP messages.

The Draft List plugin for WordPress up to version 2.6.3 has a Stored XSS vulnerability via draft post titles. Authenticated attackers with author-level access can inject scripts that execute for users without edit capabilities.

The KIA Subtitle plugin for WordPress up to version 4.0.1 is vulnerable to Stored Cross-Site Scripting via the `before` and `after` attributes of the `the-subtitle` shortcode, due to insufficient input sanitization and output escaping.