CVE Vulnerability Catalog

The Customer Email Verification for WooCommerce WordPress plugin before version 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

UpSnap, a wake on lan web app, versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser. An unauthenticated network-adjacent attacker can register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution.

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. Meta tags named pdf-webkit-KEY are converted to wkhtmltopdf command line options without an allow list, allowing override of module defaults and options passed to new.

In OpenStack Designate before 22.0.1, zone creation checks are scoped to the target pool only. An authenticated user can bypass them by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack and DNS denial of service.

UpSnap before 5.4.0 has an OS command injection vulnerability in device management due to unsafe shell command template interpolation using the ip and mac fields. User-controlled values can be inserted into wake_cmd and shutdown_cmd templates and executed without sanitization, resulting in authenticated RCE. A low-privileged user with permission to create or edit devices can execute arbitrary OS commands on the UpSnap server.

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme.

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.

The type=track branch authorizes only on _is_my_case(t_attach.case) and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaking not-yet-released coordinator material to vendors on the case.

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path traversal sequences, potentially allowing file access or overwriting outside the designated restore directory.

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution.

Budibase prior to 3.40.1 did not verify that the final request destination matches the datasource origin, allowing an unauthenticated caller of a public query endpoint to supply an attacker-controlled host and receive stored credentials. This issue is fixed in version 3.40.1.

A flaw in the cluster-curator-controller component allows a local user to create a ClusterCurator resource with a specific naming convention, triggering the creation of a cluster-scoped ClusterRoleBinding. This enables privilege escalation from namespace-local access to cluster-wide control.

A flaw in the cluster-curator-controller component of multicluster engine (MCE) allows a tenant with create or update permissions on ClusterCurator resources to inject an arbitrary Job specification. The CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension.

A flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount.

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions.

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil.

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file.