CVE Vulnerability Catalog

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. It is due to insufficient input validation in specific UI features. The attacker must have valid administrative credentials.

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. The cause is insufficient input validation in specific UI features; exploitation requires valid administrative credentials.

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms.

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could inject malicious code into specific pages of the interface.

Multiple reflected XSS vulnerabilities exist in the web-based management interface of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in the victim's context.

W libarchive bsdtar przed wersją 3.8.1 odkryto problem w funkcji apply_substitution w pliku tar/subst.c, który występuje podczas przetwarzania stworzonych reguł substytucji -s. Może to prowadzić do nieograniczonego przydzielania pamięci i skutkować awarią z powodu braku pamięci (Out-of-Memory crash).

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

An attacker with a valid read-only account can bypass Doris MCP Server's read-only mode due to improper access control, allowing modifications that should have been prevented. The issue is fixed in version 0.6.0.

The FunnelKit Automations plugin for WordPress and WooCommerce up to 3.6.4.1 is vulnerable to Missing Authorization in the bwfan_test_email AJAX handler. The nonce is publicly exposed to all visitors, and check_nonce() accepts low-privilege authenticated users. This allows authenticated attackers with Subscriber-level access to send arbitrary emails from the site.

The FunnelKit Automations plugin for WordPress and WooCommerce in versions up to and including 3.6.4.1 is vulnerable to Sensitive Information Exposure via the '/wc-coupons/' REST API endpoint. The endpoint is marked as public (public_api = true) and registered with permission_callback => '__return_true', bypassing authentication and capability checks. This allows unauthenticated attackers to extract WooCommerce coupon codes, coupon IDs, and expiration status.

The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report when the automatic sharing setting is enabled.

The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to and including 2.2.7 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

The Graphina – Elementor Charts and Graphs plugin for WordPress (versions up to and including 3.1.8) is vulnerable to stored XSS via multiple chart widgets due to insufficient input sanitization and output escaping on data attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user views the page.

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured.

The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products.

The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all versions up to, and including, 1.8.5. This allows authenticated attackers with Subscriber-level access and above to update the plugin's config.

Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5. This is due to the plugin not validating user-supplied URLs before passing them to the wp_remote_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.