CVE Vulnerability Catalog

The Sastra Essential Addons for Elementor plugin in versions up to and including 1.2.3 contains a PHP Object Injection vulnerability exploitable by a user with Author privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets in the codebase.

The Frisbii Pay plugin in versions up to and including 1.8.19 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes in the codebase.

The WP Media folders plugin in versions up to and including 1.1.10 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

The Finale Lite plugin in versions up to and including 2.21.0 contains a PHP Object Injection vulnerability exploitable by a user with Shop manager privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.

The News Kit Elementor Addons plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a user with Subscriber privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

The myPOS Checkout plugin in versions up to and including 1.4.5 contains a PHP Object Injection vulnerability exploitable by a user with Shop manager privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.

The BuddyPress Xprofile Custom Field Types plugin in versions up to and including 1.3.1 contains a PHP Object Injection vulnerability exploitable by a user with Subscriber privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

The Dynamic QR Code – generator plugin in versions up to and including 1.0.1 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.

The Extra Fees Plugin for WooCommerce in versions up to and including 4.4.0 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

The Zippy plugin in versions up to and including 1.7.0 contains a PHP Object Injection vulnerability exploitable by a user with Editor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available classes.

The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.

P-Net before 1.0.3 does not release the RPC session allocated for a request naming an unknown interface or object UUID and does not start a timeout for it. Repeated requests with different UUIDs exhaust available sessions, after which the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until restarted.

ASP.NET Core has incorrect default permissions that allow an authorized attacker to elevate privileges locally. The issue concerns the default permission configuration in the ASP.NET Core environment.

P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected due to incorrect endianness of its data representation. The session and its AR remain allocated, so repeated requests exhaust available sessions, after which the device stops answering new RPC requests, including Connect, until restarted.

P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user-specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device.

P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the APDU status offset was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer.

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, VLAN tags and PROFINET FrameID. The VLAN tag loop has no upper bound, so a truncated frame or a frame consisting only of VLAN tags causes a read past the end of the receive buffer.

P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device.

P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advances to the next port, so the request never completes and the device stops responding.

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) is used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer.