CVE Vulnerability Catalog

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform.

Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations.

An Improper Authentication vulnerability (CWE-287) in Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password.

The Joomla extension Fabrik before version 4.6.8 has an unauthenticated remote code execution vulnerability. An attacker can execute arbitrary code by using the frontend listfilter model.

The device's PROFINET service is vulnerable to a buffer overflow in the default configuration. An unauthenticated remote attacker could exploit this to reboot the device or execute arbitrary code.

The Tablesome Table plugin for WordPress (versions up to 1.2.9) is vulnerable to blind SQL injection. An attacker can exploit improper neutralization of special elements in SQL commands.

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the plugin's own posts.

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of packages installed through its remote management interface, nor protect those requests against replay. An attacker who can obtain or replay a valid signed management request can install and execute arbitrary code (remote code execution).

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths. Unauthenticated users can upload arbitrary files, including PHP code, which can lead to remote code execution.

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters, forcing ArgoCD on spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation.

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user (tenant) to manipulate the GitOpsCluster controller, redirecting sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This can lead to disclosure of critical information and bypass of security policies within ArgoCD AppProjects.

In the Linux kernel's ksmbd server, there is a missing validation of the minimum PDU size for transform requests. A packet with SMB2_TRANSFORM_PROTO_NUM bypasses the check, potentially leading to out-of-bounds read and disclosure of data to an unauthenticated client.

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

Improper TLS hostname verification in Apache HttpComponents Client 5.4 or newer. The HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker who can intercept and modify traffic can impersonate the server by presenting a valid certificate for a different domain. The classic version is not affected. Upgrade to at least 5.6.4 is recommended.

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.