CVE Vulnerability Catalog

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). A high-privileged attacker with local access could exploit it, leading to code execution and filesystem access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.

The WP Rocket plugin for WordPress (versions before 3.23.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured security mechanisms.

The BeeTienda e-commerce platform (latest demo version) is vulnerable to reflected Cross-Site Scripting (XSS) in the 'search' parameter of the product list endpoint. Lack of proper input sanitization causes malicious payloads to be displayed insecurely in the HTML response, allowing arbitrary JavaScript execution in the victim's browser.

In the ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c), the 8-byte host-command request header was copied from the SPI Rx FIFO directly into the shared receive buffer data->in_msg, with protocol version and derived packet length checked only afterwards. The interrupt handler also accepted a chip-select assertion and an Rx-valid-length (RVLI) interrupt in any driver state other than SHI_STATE_DISABLED, allowing a new header to be parsed while the host-command thread was still processing the previous request from the same buffer. As a result of the race, the command handler could be handed a 65535-byte input length over a 256-byte buffer.

The Redux Framework plugin for WordPress (all versions up to and including 4.5.11) is vulnerable to privilege escalation. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist restrictions, allowing authenticated attackers with Subscriber-level access and above to set an arbitrary role (e.g., Administrator) during a profile update if a plugin or theme using this framework has added at least one user profile field leveraging Redux_Users::set_profile/set_section/set_field.

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is identical on every site instead of a per-site secret. This allows unauthenticated users to read newsletter sending logs, including recipient email addresses.

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check user capabilities on several newsletter-management actions. Any authenticated subscriber-level user can synchronize all site users into a mailing list and drive the newsletter send queue.

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint. Attackers can overwrite arbitrary plugin options, including the shared secret that guards its own privileged endpoints.

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives. This allows unauthenticated attackers to mark orders as paid without any payment being made, as well as to force other orders into a failed state.