CVE Vulnerability Catalog

A potential vulnerability in Lenovo Software Fix that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges.

The access_key and connection_string connection properties were not marked as sensitive in the secrets masker in Apache Airflow. A user with read permission could see their values in the Connection UI and in logs when a connection was accidentally logged. This affects Azure Service Bus and potentially other providers using the same fields.

A potential DLL hijacking vulnerability in Lenovo Service Bridge that could allow a local authenticated user to execute code with elevated privileges under certain conditions.

The MyRewards plugin (Long Watch Studio / woorewards) through version 5.7.3 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they should not be permitted to perform.

The WP Royal Royal Elementor Addons plugin, versions up to 1.7.1056, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Nelio AB Testing plugin for WordPress in versions up to and including 8.2.8 contains a missing authorization vulnerability. This may allow exploitation of incorrectly configured access control security levels.

The Themeum Tutor LMS plugin, versions up to 3.9.7, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects COMPE: from n/a through <= 1.1.4.

The Categories Images plugin (Zahlan) through version 3.3.1 contains a DOM-Based Cross-site Scripting vulnerability due to improper neutralization of input during web page generation. Malicious input may execute in the user's browser context.

The ThemeGrill Demo Importer plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. The issue affects versions up to and including 2.0.0.6.

The 3D viewer – Embed 3D Models plugin (bPlugins) through version 1.8.5 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

Missing Authorization vulnerability in BlockArt Magazine Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Magazine Blocks through version 1.8.3.

An LDAP injection vulnerability in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library affects all prov modules. The issue is associated with the LDAPStoreHelper program files.

XWiki Platform contains a reflected cross-site scripting (XSS) vulnerability in the comparison view between page revisions, allowing JavaScript execution in the user's browser. Affects versions 10.4-rc-1 through 16.10.15, 17.0.0-rc-1 through 17.4.7, and 17.5.0-rc-1 through 17.10.0. If the user is an admin, this can affect the confidentiality, integrity, and availability of the whole XWiki instance.

SpiceDB versions 1.49.0 through 1.51.0, when started with log level info, write the full datastore DSN including the plaintext password into the startup configuration log inside DatastoreConfig.URI. The issue is fixed in version 1.51.1.

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.

Serendipity versions 2.6-beta2 and below have a serendipity_setCookie() function in include/functions_config.inc.php that uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of setcookie(). An attacker who can influence the Host header at login time (e.g., via MITM, reverse proxy misconfiguration, or load balancer manipulation) can force authentication cookies, including session and auto-login tokens, to be scoped to an attacker-controlled domain.

The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory.

Jellyfin before version 10.11.7 contains a denial of service vulnerability in the SyncPlay group creation endpoint. An authenticated user can create groups with unlimited name sizes, leading to endpoint lockout and increased memory usage, potentially causing an out-of-memory crash.

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction – a victim must open a malicious file.