CVE Vulnerability Catalog

Unauthenticated remote code execution vulnerability in OpenChamber 1.11.7, allowing remote attackers to execute arbitrary shell commands by sending crafted POST requests to /api/fs/exec, which passes commands verbatim to Node.js spawn() without validation.

An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.

Unauthenticated Privilege Escalation vulnerability in Kadence WooCommerce Email Designer versions up to 1.5.19.

SQL Injection vulnerability in Loca Software Informatics Technology Ltd. Co. CMS due to improper neutralization of special elements in an SQL command. The issue affects CMS through 06082026.

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console, leading to full unauthenticated takeover of the GlassFish domain until the token expires.

In Apache CXF's DefaultEncryptingCodeDataProvider, an authorization code can be redeemed an unlimited number of times due to a flaw in the removeCodeGrant implementation. This violates the RFC requirement that the authorization code must not be used more than once. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. Note that self-issued ID tokens are not accepted by default. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT can substitute code_challenge, code_challenge_method, nonce, and state values, undermining PKCE integrity and OpenID Connect replay protection. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed.

In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.

The Conditional Authentication script does not correctly enforce the completion of all required authentication steps in a specific multi-step pattern. An attacker can bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution.

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine. This allows anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data.

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.