CVE Vulnerability Catalog

The Advanced Custom Fields: Extended plugin for WordPress up to version 0.9.2.3 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker between Lemur and the LDAP server to intercept all authentication credentials.

Prior to 4.08.010, the previewServlet in efw4.X serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin.

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error.

The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.

The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.

HashiCorp Nomad's exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user via a symlink attack. The vulnerability is fixed in version 0.1.2 of the exec2 task driver.

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack.

A vulnerability in the web-based management interface of an AOS-10 Gateway could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation could disclose confidential system information, potentially enabling further attacks.

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this to maintain unauthorized access even after the account is disabled.

vLLM is an inference and serving engine for large language models. From versions 0.18.0 to before 0.20.0, the extract_hidden_states function in vLLM returns a tensor with an incorrect shape after the first decode step, leading to a RuntimeError and crashing the EngineCore process.

sse-channel is an SSE implementation for Node.js HTTP request/response streams. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream.

In NanaZip from 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser. The vulnerability is triggered when opening a crafted UFS filesystem image, with the attacker controlling the write offset within a ~254-byte window past the heap allocation boundary.

A stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. Triggered by opening a crafted ZealFS v1 image, an attacker-controlled BitmapSize field drives an unbounded loop reading past the stack-allocated ZEALFS_V1_HEADER.

The ip-address library before version 10.1.1 does not HTML-escape attacker-controlled content before embedding it in returned HTML strings. An application passing untrusted input to Address6 and rendering the output as HTML is vulnerable to cross-site scripting.

OpenTelemetry.Exporter.OpenTelemetryProtocol versions 1.8.0 to 1.15.2, when disk retry was enabled without a configured directory path, silently stored and loaded *.blob files under the shared system temporary directory. On multi-user systems this lets other local accounts write crafted blob files, read application blob files, or fill disk space. The issue is fixed in 1.15.3.

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition.

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition.