CVE Vulnerability Catalog

The tar.Reader function in Go can allocate an unbounded amount of memory when reading a maliciously crafted archive containing a large number of sparse regions encoded in the 'old GNU sparse map' format.

On Linux, if the target of Root.Chmod is replaced with a symlink during the chmod operation, Chmod can operate on the symlink target even if it lies outside the root. The fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag. Root.Chmod checks its target before acting and returns an error if the target is a symlink outside the root, so impact is limited to cases where the target is replaced between check and operation.

The Elementor Website Builder plugin for WordPress up to version 3.35.5 contains a Stored XSS vulnerability via several widget parameters. Insufficient input sanitization and output escaping allow attackers with contributor-level access or higher to inject arbitrary scripts.

The Gravity Forms plugin for WordPress up to version 2.9.30 is vulnerable to Reflected XSS via the `form_ids` parameter in the `gform_get_config` AJAX action. This is due to the `GFCommon::send_json()` method outputting JSON data wrapped in HTML comments with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets, allowing injected HTML/script tags. The `config_nonce` is publicly embedded on every page with a Gravity Forms form, making it identical for all unauthenticated visitors within a 12-hour nonce tick. This allows unauthenticated attackers to inject arbitrary web scripts if they can trick a user into clicking a link. The vulnerability does not work against authenticated users.

The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.

The Gravity Forms plugin for WordPress up to version 2.9.30 has a Stored XSS vulnerability in the Credit Card field's 'Card Type' sub-field. The get_value_entry_detail() method outputs the value without escaping, and get_value_save_entry() accepts unsanitized input. The Card Type field is not rendered on the frontend but the backend accepts it from POST requests. Unauthenticated attackers can inject arbitrary scripts that execute when an admin views the entry in the dashboard.

The Hustle plugin for WordPress up to version 7.8.10.2 has an unauthorized data modification vulnerability due to a missing capability check in the 'hustle_module_converted' AJAX action. Unauthenticated attackers can forge conversion events for any Hustle module, including draft modules.

The Score extension in MediaWiki (The Wikimedia Foundation) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

PingIDM (formerly ForgeRock Identity Management) has insufficient granularity of access control for Remote Connector Servers (RCS) in client mode. Attackers can spoof a client-mode RCS to intercept or modify identity security properties such as passwords and account recovery information.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.33 fails to check proper capabilities in multiple AJAX controller actions. Missing checkForCap() and validatePermission() calls allow authenticated attackers with Contributor-level access and above to enumerate slider metadata and create, modify, and delete image storage records.

The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.

The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

The official Java SDK for Model Context Protocol (MCP) contains a DNS rebinding vulnerability. Prior to version 1.0.0, an attacker can access a local or network-private MCP server via a victim's browser, allowing arbitrary tool calls on the server.

Aardvark-dns versions 1.16.0 to 1.17.0 have a vulnerability where a truncated TCP DNS query followed by a connection reset causes an infinite error loop at 100% CPU usage.

Electron before versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 contains a vulnerability where a child window can be navigated by an unrelated renderer if both use the same target name. This can lead to privilege escalation, and if nodeIntegration is enabled or sandbox disabled, to remote code execution.

LibreChat prior to version 0.8.4 trusts the 'name' field returned by the execute_code sandbox when persisting code-generated artifacts. An attacker can use traversal sequences (e.g., '../../') in the filename, leading to arbitrary file write on the server without validation.

Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.

Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.

xdg-dbus-proxy before version 0.1.7 has a policy parser vulnerability that allows bypassing eavesdrop restrictions. The proxy mishandles cases like 'eavesdrop ='true'' (with a space before the equals sign), enabling clients to intercept D-Bus messages they should not have access to.