CVE Vulnerability Catalog

The Blog2Social plugin for WordPress up to version 8.7.0 lacks a capability check in the 'deleteUserCcDraftPost' function. An authenticated attacker with Subscriber-level access or higher can move arbitrary posts to trash.

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16, and v8.2 versions prior to 8.2.1.

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented EKU requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and v8.2 versions prior to 8.2.2.

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list.

Sentry-Javascript versions 10.11.0 to before 10.27.0 with sendDefaultPii: true can inadvertently send sensitive HTTP headers, including Cookie, to Sentry. These headers are stored in the Sentry organization as part of the trace and could be used by persons with access.

From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

The Perfect Brands for WooCommerce plugin for WordPress in versions up to and including 3.6.2 is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode. This is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query.

A vulnerability in Blurams Lumi Security Camera (A31C) firmware v23.1227.472.2926 allows a local physical attacker to execute arbitrary code by overwriting the bootloader on the SD card.

Hard-coded configuration values exist in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. This may lead to disclosure of sensitive information or facilitate exploitation by attackers.

SOGo 5.12.3 is vulnerable to Cross-Site Scripting (XSS) via the "userName" parameter. The vulnerability allows injection of malicious JavaScript code that can be executed in the victim's browser.

Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service.

IBM Concert versions 1.0.0 through 2.0.0 use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.

Improper input validation in AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service.

Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability.

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The issue is in the add() and getPost() functions within ArticleAction.class.php due to improper neutralization of user input in the article title field.

OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. This allows an attacker to inject malicious scripts into the page, which can be executed in the victim's browser.

In Cinnamon kotaemon 0.11.0, the _may_extract_zip function in libs/ktem/ktem/index/file/ui.py does not check the contents of uploaded ZIP files. Although contents are extracted into a temporary folder, successfully uploading a ZIP bomb can still cause excessive resource consumption during decompression, and if no further files are uploaded, extracted data may occupy disk space and potentially render the system unavailable.

IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized user.

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads with thousands of parameters within the default 100KB limit, causing elevated CPU and memory usage.