CVE Vulnerability Catalog

libcurl may in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different services. A logical error in the connection pool management causes an application request to incorrectly reuse an existing connection authenticated for a different service.

A vulnerability allows reusing an existing live connection for a new transfer using STARTTLS even when the TLS configuration mismatches, potentially leading to unauthorized access or man-in-the-middle attacks.

In IMS, a vulnerability allows out-of-bounds read due to missing bounds check. This could lead to remote denial of service without requiring additional execution privileges.

A vulnerability in curl causes the tool layer to skip initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS when using a schemeless URL with `--proto-default sftp` (or scp), while libcurl establishes the SFTP/SCP connection. This results in curl connecting to an unverified SSH remote host without error.

A vulnerability in libcurl causes the Authorization header intended for the original host to be incorrectly forwarded to a different host when reusing a handle for HTTP transfers with Digest authentication.

Curl lacks an upper bound on memory allocation for unacknowledged WebSocket PING frames, allowing a malicious server to exhaust all available memory by sending rapid sequential PING messages.

A vulnerability in the libcurl library involves the connection pool, which may retain connections using default native CA trust. When an application switches a handle to custom CA material, old connections might still be reused with the original trust settings.

A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service (DoS) against a curl or libcurl client. The helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, enabling a connected QUIC peer to continuously stream empty datagrams and indefinitely stall the client.

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

The Printcart Web to Print Product Designer for WooCommerce plugin up to version 2.5.2 is vulnerable to arbitrary file deletion due to insufficient path validation in the store_design_data() function. The user-supplied 'nbd_item_key' POST parameter is sanitized only with sanitize_text_field(), which does not strip path traversal sequences, and then passed directly to Nbdesigner_IO::delete_folder() and PHP's rename().

The JSON API User plugin for WordPress up to version 4.1.0 is vulnerable to Stored Cross-Site Scripting. An attacker with subscriber-level access or higher can inject malicious scripts via the 'content' parameter of the post_comment API endpoint and self-approve the comment, bypassing moderation.

The MotoPress Appointment Booking plugin for WordPress up to version 2.4.4 contains an authorization bypass vulnerability via user-controlled key. Unauthenticated attackers can overwrite customer data (name, email, phone, customer_id) in unconfirmed victim bookings by exploiting a publicly accessible REST endpoint.

The CM Business Directory plugin for WordPress up to version 1.5.7 is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when users visit affected pages.

The Ultimate Member plugin for WordPress is vulnerable to stored XSS via the 'about_me' parameter in versions up to 2.11.4 inclusive due to insufficient input sanitization and output escaping.

The AR for WooCommerce plugin for WordPress up to version 8.40 is vulnerable to Directory Traversal via the 'file' parameter. Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information. Three access controls fail: nonces are generated without authentication, the AES-256-CBC encryption key is predictable, and the Referer check is easily bypassed.

The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can read all debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. After wp_safe_remote_get() fails (blocking private IPs), the plugin falls back to GuzzleHttp\Client::request() with no SSRF protection and disabled TLS verification. This allows authenticated attackers with administrator-level access to make requests to arbitrary internal services, such as cloud metadata endpoints.

A vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. The issue stems from external control of file name or path.

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open a specified URL.