CVE Vulnerability Catalog

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

The HCL AppScan Azure Boards Plugin may expose secrets in plaintext during pipeline execution. Depending on pipeline configuration, secrets could be visible in task outputs, debug logs, environment variable dumps, or build agent scripts despite UI masking.

An incorrect permission assignment in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Extensions for Leaflet Map plugin allows Stored XSS. This issue affects Extensions for Leaflet Map through version 6.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress ND Shortcodes For Visual Composer plugin allows Stored XSS. This issue affects ND Shortcodes For Visual Composer through version 7.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Waitlist Woocommerce (Back in stock notifier) plugin allows Stored XSS. This issue affects Waitlist Woocommerce (Back in stock notifier) through version 2.9.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin allows Stored XSS. This issue affects Restaurant Menu – Food Ordering System – Table Reservation through version 2.4.4.

The ЮKassa for WooCommerce plugin is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.17.3.

The myCred plugin is vulnerable to authorization bypass through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.0-beta.1.

The Page Restriction WordPress (WP) plugin by miniOrange is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.6.0.

The WP Desk ShopMagic plugin (shopmagic-for-woocommerce) has an insertion of sensitive information into an externally-accessible file or directory vulnerability, allowing retrieval of embedded sensitive data. This issue affects ShopMagic versions up to and including 4.9.1.

The WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) up to version 0.5.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User-supplied data is not properly sanitized, allowing malicious scripts to be stored.

The Contact Form Email plugin (contact-form-to-email) by Codepeople contains a Stored Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.3.68.

The Amelia plugin for WordPress (versions up to 2.4.11) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This may allow manipulation of database queries.

The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.

The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The Cozmoslabs Profile Builder plugin (versions through 4.0.4) contains an incorrect privilege assignment vulnerability that allows privilege escalation. This may let low-privileged users gain higher privileges on a WordPress site.

An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.