CVE Vulnerability Catalog

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the crafted directory name is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

Unauthenticated Broken Access Control vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. An attacker without authentication can exploit this to perform unauthorized actions.

CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web UI shown to other vault users.

HTML injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated attacker can affect web UI contents displayed to other users.

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.

In mod_cluster's AdvertiseListenerImpl, a single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught. This causes the advertise listener thread to terminate permanently, and the failure is silent (isListening() continues to return true) until the node is restarted.

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field.

The EWWW Image Optimizer plugin for WordPress up to version 8.7.3 is vulnerable to Stored Cross-Site Scripting via the 'data-script' attribute in post content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with associated booking items and payment records.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in some AJAX actions, allowing unauthenticated users to retrieve personal information of customers who booked an appointment, including name, email, phone number, and postal address.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments and trigger notification emails to affected customers.

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding the plugin's own roles.

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitizing file contents, allowing users with upload capability, such as Authors, to upload files containing malicious JavaScript that executes in the browser of any user who opens it (Stored XSS). On multisite, this also overrides an upload-type restriction set by the network administrator.