CVE Vulnerability Catalog

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.

An improper control of dynamically-managed code resources vulnerability in the WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-2, and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft.

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the POST parameter 'p' in '/api/v2.1/repos/{repo_id}/file/', allowing arbitrary code execution in the victim's browser.

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the PUT parameter 'name' in '/api/v2.1/user/', allowing arbitrary code execution in the victim's browser.

A flaw was found in ansible-collection-community-general that allows information exposure of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.

The Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.9.4 is vulnerable to authorization bypass. The disable() function does not properly verify a user's authorization, allowing authenticated attackers with contributor-level access and above to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption.

The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts.

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated attackers to extract configuration data.

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation, affecting deployments configured with the SSHPOP provisioner.

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

RomM (ROM Manager) prior to 4.4.1 and 4.4.1-beta.2 allows an authenticated user to delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe in the function main.cpp, which can lead to potential information leakage and crash.

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

A vulnerability in HCLTech GRAGON before version 7.6.0 allows a remote attacker to execute arbitrary code via APIs that do not enforce limits on the number or size of requests.

A Cross Site Scripting (XSS) vulnerability was found in HCLTech DRAGON prior to version 7.6.0. Missing security directives allow a remote attacker to execute arbitrary code in the victim's browser context.

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)