CVE Vulnerability Catalog

Missing authorization check in the editor controller task in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. The EditorController::getBlogPosts() method reads the order parameter and invokes getBlogPosts(), omitting the GridboxHelper::checkUserEditLevel() check used by other tasks in the controller.

Unauthenticated SQL injection vulnerability in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. On store product list pages, the sort-by URL parameter value is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(); when it does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without allowlist validation.

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5.

The Qode Membership plugin for WordPress in versions up to and including 2.0.6.2 contains a typographic error in the Facebook OAuth token verification guard ($check_social_useqoder instead of $check_social_user). This causes the guard condition to always evaluate true, rendering the Graph API token verification dead code and allowing unauthenticated attackers to log in as any account, including Administrator, by supplying a login name in the response[email] parameter.

This vulnerability allows an authenticated IPMI administrator to execute commands as the operating system root user on the BMC. This enables full compromise of the BMC.

This vulnerability allows an authenticated IPMI Administrator to read and write arbitrary BMC physical memory. This enables code execution on the BMC operating system.

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

An OS command injection vulnerability exists due to insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When SMS management is enabled and configured, a remote attacker with required privileges could exploit insufficient input validation to execute arbitrary commands.

A hard-coded cryptographic key vulnerability exists in OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared key material and impersonate devices that have not regenerated their keys.

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack.

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to and including 4.61.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.

The Kirki plugin for WordPress in versions up to and including 6.2.5 is vulnerable to privilege escalation via PHP Object Injection. The flaw stems from a missing capability check in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher and deserialization of untrusted input, allowing authenticated attackers with Subscriber-level access and above to inject a PHP object. A POP chain enables overwriting an administrator's password and gaining administrative access.