CVE Vulnerability Catalog

A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other administrators access the template customisation view, allowing JavaScript code to be executed within the application’s security context and potentially compromising the sessions of other users with administrative privileges.

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the client-provided name without checking content or restricting file types. An administrator can upload PHP files to a web-accessible directory, potentially leading to arbitrary code execution.

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.

In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.

In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.

Joro before version 1.1.1 in default proxy mode exposes a local API on 127.0.0.1:9090 with no authentication and wildcard CORS. A malicious website can reach privileged endpoints, including uploading a native plugin and triggering a restart, leading to unauthenticated remote code execution as the operator's user.

A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.

A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. TCP ports 43210 and 43211 are accessible in the default L3 VRF, and crafted input can lead to code execution or crash of the S1HAL process causing device reload.

Looking Glass prior to version 1.3.5 contains an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.

In the current development version of Eclipse aeriOS, the KrakenD instance in the API Gateway had disable_jwk_security hard-coded to true, disabling TLS certificate verification when retrieving JWKS. This could allow an attacker to intercept communication and provide a malicious JWKS, compromising token validation. The issue has been fixed by making the parameter configurable and defaulting to false.

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component.

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. Affects versions from 0.0.0 to 1.12.0 and from 2.0.0 to 2.1.3.

SiYuan before version 3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.