CVE Vulnerability Catalog

The Delete All Comments of wordpress plugin in versions up to 7.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This allows attackers to exploit the misconfigured access control.

The Zero Spam plugin in versions up to and including 5.7.11 contains a Bypass vulnerability that allows an unauthenticated attacker to circumvent protection mechanisms.

The Motors plugin by StylemixThemes in versions up to and including 1.4.124 contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data.

The Advanced Google reCAPTCHA plugin version 5.40 and earlier contains a vulnerability of unauthenticated broken authentication. This means an attacker can bypass the login process without providing valid credentials.

In the OIDC implementation of Keycloak, specifically in the Device Authorization Grant flow, the minimum authentication level required by a client configuration is not checked. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.

A vulnerability in Cloud Foundry UAA (versions 4.5.0 to 79.6.0) stems from insufficient verification of data authenticity in the external OIDC login callback. It allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session by submitting a valid UAA JWT as the callback's id_token parameter.

Memory corruption occurs when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. This may lead to unexpected system behavior or potential exploitation by an attacker.

The vulnerability causes memory corruption when processing camera operations due to an out-of-bounds write during driver updates.

The vulnerability causes memory corruption when processing camera CRE driver operations due to improper handling of buffer limits during hardware update preparation.

The vulnerability causes memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

The vulnerability causes memory corruption when processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory size.

The vulnerability causes memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

The vulnerability allows unauthenticated broken access control in WP Event Solution versions up to 4.1.25.

The vulnerability allows contributor-level broken access control in WDS MCP Content Manager versions up to 3.10.4.