CVE Vulnerability Catalog

The IATO MCP plugin (iato-mcp) up to version 1.12.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Faktur Pro for WooCommerce (ZWEISCHNEIDER plugin) up to version 3.2.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain access to functions they should not have permissions for.

A security vulnerability in vllm-project vLLM up to 0.31.0 causes an out-of-bounds read in the function conv_ssm_forward in the file mamba_mixer2.py, within the Completions Request Handler component. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A flaw has been found in imgproxy up to 4.0.17 in the sanitizeElement function of processing/svg/svg.go in the SVG Handler component. Manipulation of input leads to cross site scripting, and the attack can be launched remotely. The exploit has been published and may be used; the project has not responded to the issue report.

A vulnerability was detected in uptrace up to 2.1.0-beta.8 in the Login function of pkg/org/user_handler.go. Manipulation leads to information exposure through error messages. The attack can be initiated remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function. The attack can be performed remotely and the exploit has been made publicly available.

A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Drug Recommendation System 1.0 in Admin/add_drug.php. Input manipulation leads to client-side script execution. The attack can be performed remotely and the exploit has been publicly released.

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3 in loginsystem/admin/change-password.php within the Change Password Handler component. Manipulation of the currentpassword argument causes incorrect authorization. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was discovered in jishenghua jshERP up to 3.5 in the updateAccountHeadAndDetail function of AccountHeadService.java within the Financial Receipt Update Handler component. Manipulation leads to improper authorization. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1 in ParamController.java within the Parameter Submit Management component. Manipulation of the initPassword argument results in improper authorization. The attack can be launched remotely and the exploit has been made public.

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.

A vulnerability was found in PickMall Lilishop up to 4.2.4 in /buyer/trade/receipt within the Buyer Invoice List component. Manipulation of the memberId argument leads to authorization bypass. The attack can be launched remotely and the exploit has been disclosed to the public.

A vulnerability was found in yogeshojha reNgine up to 2.2.0 in the subdomain_discovery function of web/reNgine/tasks.py within the listTargets Endpoint component. Manipulation of the Name argument results in OS command injection. The attack can be launched remotely and the exploit has been made public.

In Punk versions from 0.48 before 0.55 for Perl, Extended CONNECT requests are routed to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD's GSSAPI authentication handling in the PAM responder, where cached connection state is freed without clearing the reference pointer. A local user can send an additional request over the same connection, causing the service to access invalid memory and terminate unexpectedly.

A flaw was found in SSSD where, in LDAP environments configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method can bypass access control restrictions.