CVE Vulnerability Catalog

A use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, it could allow remote attackers to compromise the security of the system.

A use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, it could allow remote attackers to compromise the security of the system.

In the HOTP authentication mechanism of keycloak-services, the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a user's password can exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

In the Pushed Authorization Request (PAR) implementation of keycloak-services, restarting an authentication flow incorrectly clears the internal markers tracking PAR consumption while leaving the request active. An attacker can reuse the same authorization request to obtain multiple access tokens, bypassing single-use requirements.

In the client registration component of Keycloak, when a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to reveal secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text.

In the JWT Authorization Grant implementation of keycloak-services, when an OIDC or Google identity provider is configured with login restrictions such as claim filtering, these checks are applied during standard browser logins but skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

A NULL pointer dereference flaw in 389-ds-base occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with ModifyDN permission on the affected entry can crash the directory server.

The Password Protected plugin for WordPress is vulnerable to stored cross-site scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Once the Freemius opt-in is complete, the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without capability, nonce, or purchase validation, and stores it in a persistent site-wide administrative notice.

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement. This allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation. This allows unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.

The Community Events WordPress plugin before 1.6.0 lacks authorisation and nonce checks when processing public event submissions and does not escape several submitted values before outputting them in the administration dashboard and public calendar. This allows unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator reviewing the submission.

The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler. This allows users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it. This allows unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission. This allows unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks, allowing an authenticated low-privileged user such as the Monitor role to view sensitive system properties and JVM configuration details that should be restricted.

WildFly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker with access to the IIOP port may construct and send malicious objects to achieve deserialization, if the target EJB allows untyped method parameters and depending on available gadget chains in the classpath.

In nvm versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . and # but not backslash. A version string containing # closes the address early and the rest is parsed as sed commands, allowing shell command execution with GNU sed or file read/write with BSD sed.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records. This allows unauthenticated attackers to delete arbitrary statistics entries.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics. This allows attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.