CVE Vulnerability Catalog

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.

The Kirki plugin for WordPress in versions up to and including 6.2.5 is vulnerable to privilege escalation via PHP Object Injection. The flaw stems from a missing capability check in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher and deserialization of untrusted input, allowing authenticated attackers with Subscriber-level access and above to inject a PHP object. A POP chain enables overwriting an administrator's password and gaining administrative access.

A vulnerability in the qs library causes the key of an empty array to be written without encoding when allowEmptyArrays: true is used, even though keys are encoded by default. A key containing &, =, or # can therefore inject parameters into the serialized query string or truncate it. Affected versions are >=6.12.0 <6.12.6, >=6.13.0 <6.13.4, >=6.14.0 <6.14.3, >=6.15.0 <6.15.4, and >=6.16.0 <6.16.2.

An improper locking vulnerability in Fortinet FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

An out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute. This allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty. This allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

Psono Server CE and EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments with URL_PREFIX, the comparison failed and the POST request was authorized with write scope instead of read scope, allowing an authenticated attacker with a read-disabled, write-enabled API key to retrieve encrypted secret data and nonces.

Psono Server CE and EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle.

Psono Server CE and EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated attacker with the user's password and one captured valid WebAuthn assertion could replay it with separate login tokens, bypassing the WebAuthn second factor.

Psono Server (CE and EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated attacker with read-only access could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file.

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days.

The Analytics Insights – Google Analytics Dashboard for WordPress plugin up to and including version 6.3.12 is vulnerable to stored cross-site scripting via the Page Title due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Payex Payment Gateway for WooCommerce plugin through version 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default. This allows unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.

The Payment Integration Wompi WordPress plugin through version 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until manually configured. This allows an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.

An untrusted pointer dereference in the firmware of certain ASUS motherboards allows a kernel-level privileged user to supply an arbitrary memory address via an I/O command, leading to tampering with system information or a system crash.

A cross-site scripting vulnerability exists in HR-Payroll-Management-System (Saruf-Ratul) in chat.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is available.

A cross-site scripting vulnerability exists in Online-Payroll-Management-System (MD-MAFUJUL-HASAN) in chat.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is available.

Rejected reason: Maintainers determined it is not a vulnerability.

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption.