CVE Vulnerability Catalog

patool before version 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Rundeck before version 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory.

Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due to the lack of proper file extension validation, an attacker could upload a malicious ASPX file and subsequently execute it on the server.

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges could store manipulated arguments in the database and subsequently cause them to be processed by the revision comparison functionality.

The Pix por Piggly (para Woocommerce) plugin contains a blind SQL injection vulnerability. The issue affects versions up to and including 2.1.2.

The WordPress plugin 'Post title marquee scroll' is vulnerable to blind SQL injection in versions up to 9.9. An attacker can manipulate input to execute unauthorized database queries.

The Site Search function in Movable Type contains an SQL injection vulnerability that may allow an unauthenticated attacker to execute arbitrary SQL queries on the affected product.

The affiliate-toolkit-starter plugin by SERVIT Software Solutions contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 3.9.1.

The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.

The OMGF WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 's' Search Parameter in comments-atom Feed in all versions up to and including 6.3.10 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, provided the front-end server serves the retained .tmp file without proper Content-Type headers.

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200 web portal allows an authenticated user to read any file or list any directory accessible to the web server user by modifying the URL with a path traversal payload.

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

In the IEEE 802.15.4 stack in Zephyr, the function ieee802154_decipher_data_frame() does not check if the frame is long enough before computing the payload length. Subtracting the header and authentication tag length from the frame length can underflow, leading to an out-of-bounds read and write. An attacker within radio range can send a short frame, causing memory corruption and system crash.

A vulnerability in the Zephyr Bluetooth Mesh stack affects the Solicitation PDU handler in sol_pdu_decrypt(). Received PDU is copied into a fixed 17-byte stack buffer without length checking, leading to stack overflow in production builds where assertions are disabled. An attacker can send a crafted advertisement to trigger out-of-bounds write without any cryptographic keys.

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present, this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.