CVE Vulnerability Catalog

Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service 9.23 and prior allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint. No fixed version is available.

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

The YITH WooCommerce Wishlist plugin up to version 4.18.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

The YITH WooCommerce Product Bundles plugin up to version 2.29.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

The Broadcast Live Video plugin up to version 7.3.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.

The FluentCommunity plugin up to version 2.11.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

The FluentForm plugin up to version 6.2.15 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.

The JetElements For Elementor plugin up to version 2.9.2.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

The e2pdf plugin up to version 1.32.57 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

The LearnPress plugin up to version 4.4.10 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used.

In the dmCodeEditor component of diem-project diem up to 5.1.3, the dmOs::join function in actions.class.php allows manipulation leading to path traversal. The attack can be launched remotely and a public exploit is already available.

In fastllm up to 0.1.8.2, the GGUFBuffer::ReadString function in gguf.cpp mishandles the len argument, causing a buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.

In fastllm up to 1.8.2, the SafeTensorItem::CreateBuffer function in src/model.cpp mishandles the data_offsets argument, causing a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

FopProducer transforms the incoming XSL-FO body by creating a TransformerFactory via TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, that feature alone does not restrict external resource access, so an external DTD or entity declared in the XSL-FO document is resolved and expanded. An external sender can therefore read files readable by the Camel process and cause it to issue requests to hosts the document names.

A use of cache containing sensitive information vulnerability exists in the Apache Camel HTTP component. The JVM-global OAuth2 token cache key omitted the requested scope, resource indicator and token endpoint, so two endpoints differing only in those fields shared a cache entry and an endpoint could be served a token minted for a different scope, resource or authorization server.

An insufficient granularity of access control vulnerability exists in the Apache Camel Platform HTTP component. The component decided proxy mode by testing whether the configured path started with the string "proxy" rather than matching exactly, so endpoints such as proxyStatus or proxy-config became proxies without the route author's intent and forwarded requests onward.

A generation of error message containing sensitive information vulnerability exists in the Apache Camel gRPC component. When a route behind a gRPC consumer failed, the exception message was placed into the gRPC status description, which is transmitted to the calling client, so an external caller could read internal error messages including class and package names, paths, host names and connection details.

An improper input validation vulnerability exists in the Apache Camel Mail component. The MimeMultipart data format retained an unfiltered path where unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied, so an external sender could set them and influence how a downstream mail producer connects and sends.