CVE Vulnerability Catalog

The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.

The WPFunnels plugin versions 3.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

MISP contains a stored cross-site scripting (XSS) vulnerability in the event graph preview feature. The event graph preview image field is accepted and stored without server-side validation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Ultimate Maps by Supsystic plugin versions 1.5.5 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Easy Google Maps plugin versions 1.14.6 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms versions up to 3.15.3. An attacker can inject malicious script without authentication.

The If-So Dynamic Content Personalization WordPress plugin through 1.10.1 is vulnerable to Reflected XSS due to improper neutralization of input during web page generation.

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages.

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availability.

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user with tag editor permission could craft a request that includes additional model data (such as User or Organisation records), enabling modification or creation of privileged accounts and escalation to site administrator.

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD. The SFTP client implementation did not check that a received reply corresponded to a previously sent request, causing unsolicited replies to be stored but never consumed. A malicious server could send such replies until client memory is exhausted.

Apache MINA SSHD allows partial authentication bypass. When the SSH server is configured to require two different public keys, the server code in component sshd-core does not enforce that the presented keys are different. A user can successfully authenticate by presenting the same key twice.

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this to cause incorrect data processing or a denial-of-service condition.

Information disclosure in BVMS 4.5 up to 12.3 allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints, the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance, leading to unauthorized read access to events of other organizations, and if the delegation is accepted, transfer of event ownership.