CVE Vulnerability Catalog

In Wazuh from version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue is patched in version 4.13.0.

Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service.

Wazuh is an open source security detection, visibility, and compliance project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint.

The Tainacan plugin for WordPress in all versions up to and including 1.0.0 is vulnerable to Information Exposure via uploaded files marked as private being exposed in wp-content without adequate protection. This allows unauthenticated attackers to extract potentially sensitive information from files marked as private.

Terraform Enterprise versions prior to 1.1.1 and 1.0.3 allow a user with specific but insufficient permissions to create state versions in a workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion. This issue affects Easy Invoice: from n/a through <= 2.1.4.

The WordPress plugin 'Show Variations as Single Products Woocommerce' has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.0.

The ThemeAtelier Better Chat Support for Messenger WordPress plugin in versions up to and including 1.2.18 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Accessibility Toolkit by WebYes' has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.0.4.

The Nelio Popups plugin for WordPress (versions up to 1.3.0) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can store a malicious script that executes in a user's browser.

The bPlugins Tiktok Feed WordPress plugin in versions up to and including 1.0.23 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Cart Weight for WooCommerce' has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.9.11.

Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4.

Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscriptions & Memberships for PayPal: from n/a through <= 1.1.7.

Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.

Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1.

The Chat Help plugin by ThemeAtelier contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.1.3.

The Travelers' Map plugin for WordPress (versions up to 2.3.2) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can store a malicious script that executes in a user's browser.

Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms (i-order-terms) allows Cross Site Request Forgery. This issue affects I Order Terms from n/a through <= 1.5.0.

Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by Tableberg: from n/a through <= 0.6.9.