CVE Vulnerability Catalog

An improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 version 16.0.0.10 and earlier (Media version 16.0.0a and earlier). If exploited, legitimate files may be overwritten by a remote authenticated attacker.

A files or directories accessible to external parties issue exists in SS1 version 16.0.0.10 and earlier (Media version: 16.0.0a and earlier). If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated attacker.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to stored cross-site scripting via several widgets in all versions up to and including 1.5.148 due to insufficient input sanitization and output escaping.

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX action in various versions. This makes it possible for authenticated attackers with Subscriber-level access and above to deactivate all of a site's plugins. While the developer added a nonce check, it is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to and including 1.9.3. Unauthenticated attackers can upload limited arbitrary files like .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg, which may enable other attacks like XSS. Only versions up to 1.8.7 were confirmed vulnerable, but the earliest tested patched version is 1.9.4.

The Pronamic Google Maps plugin for WordPress is vulnerable to stored cross-site scripting via the description field in all versions up to and including 2.4.1 due to insufficient input sanitization and output escaping.

The UsersWP plugin for WordPress (versions up to and including 1.2.42) is vulnerable to Stored Cross-Site Scripting via the 'uwp_profile' and 'uwp_profile_header' shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Beaver Builder – WordPress Page Builder plugin (versions up to 2.9.2.1) is vulnerable to reflected XSS via the 'fl_builder' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if they can trick a user into clicking a link.

A reflected cross-site scripting (XSS) vulnerability exists in the web interface of Arcserve Unified Data Protection (UDP), where unsanitized user input is improperly reflected in HTTP responses. Remote attackers with low privileges can craft malicious links that, when visited by another user, execute arbitrary JavaScript in the victim's browser. Successful exploitation may lead to session hijacking, credential theft, or other client-side impacts. The vulnerability affects all UDP versions prior to 10.2; versions 8.0 through 10.1 require patch or upgrade to 10.2; versions 7.x and earlier must be upgraded to 10.2.

A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored XSS attack. This is due to insufficient validation of user-supplied input. An attacker with Administrator or AAA Administrator role can inject malicious data to execute arbitrary script code.

A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.

The configuration of Mosh-Pro on macOS, with the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC permissions. Acquired resource access is limited to previously granted permissions, and accessing other resources prompts the user for approval in the name of Mosh-Pro, potentially disguising malicious intent. This issue was fixed in version 1.3.7.

In the Linux kernel, a change was reverted that caused the dma_buf field in struct drm_gem_object to become NULL when user space released the final GEM handle, resulting in a NULL-pointer dereference. The fix restores the use of .import_attach->dmabuf.

In the Linux kernel, the change "drm/gem-framebuffer: Use dma_buf from GEM object instance" was reverted because the dma_buf field in struct drm_gem_object is not stable over the object's lifetime. The field becomes NULL when user space releases the final GEM handle, causing a NULL-pointer dereference.

In the Linux kernel, a previous change regarding the dma_buf field in struct drm_gem_object was reverted because the field is not stable over the object's lifetime. The field becomes NULL when user space releases the final GEM handle, leading to a NULL-pointer dereference.

In the Linux kernel, a change in drm/gem-shmem was reverted that caused the dma_buf field in struct drm_gem_object to become NULL when user space released the final GEM handle, resulting in a NULL-pointer dereference. The fix restores the use of .import_attach->dmabuf.

In the Linux kernel pinmux subsystem, a race condition between pin_request() and pin_free() can leave a pin with an active use count (mux_usecount) but a NULL owner (mux_owner). This leads to a NULL pointer dereference on the next request for the same pin. The fix ensures atomic updates of mux_usecount and mux_owner under the same lock.

W jądrze systemu Linux naprawiono podatność, która mogła prowadzić do paniki systemu przy użyciu opcji montowania 'mode=lfs'. Problem występował w funkcji f2fs_map_blocks(), gdzie nieprawidłowe zarządzanie alokacją bloków mogło prowadzić do wyczerpania przestrzeni.

In the Linux kernel, a vulnerability in the rdev_addable function in the md module can lead to a NULL pointer dereference and kernel panic. The issue occurs when rdev->mddev is set to NULL before RCU synchronization, causing an error in RCU context. The fix uses READ_ONCE and checks if rdev->mddev is still alive.