CVE Vulnerability Catalog

Disputed vulnerability in zzdevelop lenosp up to 20230831, affecting an unknown part of the Adduser Page component. Manipulation of the username argument with <script>alert(1)</script> leads to cross-site scripting. The attack can be initiated remotely, but the vendor disputes the existence of the vulnerability.

In the Linux kernel, the iterate_inode_ref() function in btrfs: send has a path ref underflow issue. BUG_ON was replaced with proper error handling when building the path buffer fails. Pointers are not printed to avoid leaking kernel addresses.

The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the 'name' parameter in the machd_reader.c component.

A potential NullPointerException was discovered in ThreeTen Backport version 1.6.8 in the compareTo method of the LocalDate class. However, multiple third parties dispute the validity of this vulnerability, suggesting the report may be based on an insufficiently robust tool.

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker in a channel with an active call to keep participating in the call even if they are removed from the channel.

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Escape sequences from stdin are blocked, but those from argv are not.

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

Mattermost fails to properly restrict access to files attached to posts in an archived channel. Members can access files of archived channels even if the “Allow users to view archived channels” option is disabled.

Mattermost fails to check required permissions in the POST /api/v4/channels/stats/member_count API, resulting in channel member counts being leaked to a user without permissions.

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user causing audit log entries to be attributed to another user. This can lead to falsification of the audit trail.

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier. It allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after login.

A SQL injection vulnerability in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the ID parameter after login.

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier. A remote attacker can execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after login.

Mattermost fails to update the permissions of the current session for a user who was just demoted to guest. As a result, freshly demoted guests can change group names.

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by creating a channel name that is valid HTML. No XSS is possible though.

Vim prior to version 9.0.2121 has a heap-use-after-free vulnerability that can occur when executing the `:s` command for the first time using a sub-replace-special atom. This may lead to unsafe memory access and potential crashes of the Vim editor.