CVE Vulnerability Catalog

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.

ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.

In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges. This can lead to unauthorized modification or deletion of files on the system.

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.

The WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to and including 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes.

A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web-based attacks. The issue has been fixed in the latest version of Eaton IPP available on the Eaton download centre.

Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network-based attacker to intercept the cookie and exploit it through a man-in-the-middle attack.

Arcserve UDP Console contains an incorrectly specified destination in a communication channel vulnerability. When a user configures the activation server hostname to a dummy URL, the product may unintentionally communicate with the dummy domain, causing information disclosure.

Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate-limiting controls. This issue has been fixed in the latest version of Eaton IPP available on the Eaton download centre.

Eaton Intelligent Power Protector (IPP) contains improper input validation in one of its XML files. An attacker with admin privileges and local system access could inject malicious code resulting in arbitrary command execution.

In Wago Smart Designer versions up to 2.33.1, a low-privileged remote attacker may enumerate projects and usernames through iterative requests to a specific endpoint.

The Vantage theme for WordPress in versions up to and including 1.20.32 is vulnerable to stored cross-site scripting via Gallery block text content. Insufficient output escaping in the gallery template allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A Download of Code Without Integrity Check vulnerability in the update modules of ASUS Member Center (华硕大厅) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOCTOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download and subsequently executed with administrative privileges upon user consent.

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase. This permits a local user to make unprivileged modifications, allowing the altered resource to pass system checks and be executed with elevated privileges upon a user-initiated update.

A path traversal vulnerability in OpenHarness prior to commit dd1d235 allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can bypass the project memory directory validation and access sensitive files accessible to the OpenHarness process.

Prometheus versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 contain stored cross-site scripting vulnerabilities in the web UI where metric names and label values are injected into innerHTML without escaping. Because Prometheus v3.x defaults to UTF-8 validation allowing characters like <, >, and " in metric and label names, an attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver can execute arbitrary JavaScript in the browser of any user viewing the metric in the Graph UI. The issue is fixed in versions 3.5.2 and 3.11.2.

Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. It requires a high-privileged user with a developer role.

Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. It requires a high-privileged user with a developer role.

ApostropheCMS is an open-source Node.js CMS. A regression in commit 49d0bb7, included in version 2.17.1 of the sanitize-html package, bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. Fixed in sanitize-html 2.17.2 and ApostropheCMS 4.29.0.