CVE Vulnerability Catalog

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HollerBox: from n/a through 2.3.14.

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.

Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Visual Composer Website Builder: from n/a through 45.16.3.

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables. This issue affects Event Tickets: from n/a through 5.30.0.1.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Tickets: from n/a through 5.30.0.1.

Stored XSS vulnerability in Gutenberg Blocks by Kadence Blocks (up to 3.7.12) due to improper input neutralization during web page generation.

Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.

Missing authorization in Ultimate Post Kit (up to 4.5.5) allows exploiting incorrectly configured access control security levels.

Missing authorization in YITH WooCommerce Product Bundles (up to 2.29.0) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in MasterStudy LMS (up to 3.7.52) due to improper input neutralization.

Stored XSS vulnerability in WP Store Locator (up to 3.0.3) due to improper input neutralization.

Missing authorization in VillaTheme Core (up to 1.0.5) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in ShortPixel Image Optimizer (up to 6.5.6) due to improper input neutralization.

Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.

Improper certificate validation in the webmail of hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. The webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address.

Inefficient algorithmic complexity in the webmail's message view of the REST API in hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once.

Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number.