CVE Vulnerability Catalog

The OOPSpam Anti-Spam plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to and including 1.2.53. The plugin trusts client-controlled forwarded headers (e.g., CF-Connecting-IP, X-Forwarded-For) without verifying they originate from trusted proxies, allowing unauthenticated attackers to spoof their IP address.

The Zombify plugin for WordPress up to version 1.7.5 is vulnerable to Path Traversal due to insufficient input validation in the zf_get_file_by_url function. This allows authenticated attackers with subscriber-level access or above to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. Successful exploitation relies on a race condition as the generated file is deleted immediately.

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used in aes_decrypt_message in symmetric_encryption.py. Deserializing untrusted data with pickle can lead to arbitrary code execution.

FutureNet MA and IP-K series devices from Century Systems Co., Ltd. expose firmware version and garbage collection information on an internal web page. With a crafted HTTP request, this information can be accessed without authentication.

The RealPress WordPress plugin before version 1.1.0 registers REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.

The FuseWP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules.

The Qzzr Shortcode plugin for WordPress up to version 1.0.1 is vulnerable to Stored Cross-Site Scripting via the 'quiz' attribute in the 'qzzr' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts.

In Brave Browser Desktop before 1.83.10 with split view enabled, the 'Open Link in Split View' context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on cross-site navigation.

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the Revive Adserver UI into clicking a crafted URL and execute injected JavaScript in the victim's browser context. The vulnerability is present in admin-search.php and can be exploited via the compact parameter.

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view.

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output.

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with overly permissive permissions. In particular, the nagios.service unit had unnecessary executable permissions. Overly permissive permissions can broaden local attack surface, enabling unintended execution behaviors or abuse of service operations.

Nagios XI before 2024R1.2.2 contains a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing, account recovery link hijacking, and web cache poisoning.

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Nagios XI versions prior to 2024R1.1.2 are vulnerable to reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim's browser within the Nagios XI origin.