CVE Vulnerability Catalog

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to and including 1.1.8 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages.

A vulnerability has been found in some Dahua products that could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service.

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.

The Animation Addons for Elementor, powered by GSAP, is vulnerable to DOM-Based Stored Cross-Site Scripting in versions up to and including 2.6.7. The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.

A vulnerability has been reported in File Station 6, involving resource allocation without limits or throttling. A remote attacker with a user account can exploit this vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

A path traversal vulnerability has been reported in QNAP operating systems. A remote attacker with an administrator account can read unexpected files or system data.

A NULL pointer dereference vulnerability has been reported to affect File Station 6. A remote attacker with a user account can exploit this vulnerability to launch a denial-of-service (DoS) attack.

A path traversal vulnerability has been reported to affect License Center. A local attacker with an administrator account can exploit this vulnerability to read the contents of unexpected files or system data.

A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center, allowing remote attackers to gain privileges or hijack user identities.

The Espressif Internet of Things (IOT) framework has an out-of-bounds read issue in the BlueDroid AVRCP vendor-command parser. This issue affects versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 and has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

The ESP-IDF framework has a vulnerability in versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1 related to an out-of-bounds read flaw in the DHCP server option parser. This vulnerability allows reading adjacent memory, potentially leading to unauthorized access to data.

In Frappe LMS prior to version 2.53.0, an authenticated user could inject specially crafted content into user-editable fields that, when displayed in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL.

BuddyPress version 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows authenticated attackers to enumerate another user's complete friend list.

A vulnerability in the SubjectDnX509PrincipalExtractor component of Spring Security allows incorrect handling of malformed CN values in X.509 certificates. This can lead to reading the wrong username and potentially allow an attacker to impersonate another user.

Nimiq is a Rust implementation of the Proof-of-Stake protocol. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash.

In versions prior to 1.4.0, Nimiq has a denial-of-service vulnerability in the Ed25519 multisig delinearization code path. The Ed25519PublicKey::delinearize() method calls .unwrap() on curve point decompression, which panics when a public key is not valid.

In versions prior to 1.4.0 of Nimiq, the LightBlockchain::rebranch() function does not correctly update the macro and election state after adopting a fork chain, leading to verification issues with blocks. This can cause stalls in the light client's chain progression.

In versions prior to 1.4.0, Nimiq has a logic flaw in the BlockInclusionProof::is_block_proven function that allows a MacroBlock header to be accepted as 'proven' without cryptographic verification. This issue occurs when the hop list is empty, which can be exploited by an attacker to forge transaction inclusion proofs.

FlashMQ is an MQTT broker/server that prior to version 1.26.2 allowed authorized clients to exceed the permitted write buffer over-commit, triggering an internal safeguard exception. This exception was not catchable, leading to server abort.

In versions prior to 1.4.0, the network-libp2p library in Nimiq improperly handles DHT record verification errors, potentially leading to future queries hanging indefinitely.