CVE Vulnerability Catalog

Ghost from 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command, allowing an attacker to write data at an attacker-controlled address and disable module verification.

The c_glib bindings of Apache Thrift are vulnerable to use of uninitialized resource and return of wrong status code. This issue affects Apache Thrift before 0.25.0.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomTamano' parameter in the '/es/companysizemployees/update' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

The Repasat application is vulnerable to Cross-Site Scripting (XSS) via the 'nomOrigen' parameter in the '/es/origins/store' endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser.

A SQL injection vulnerability was discovered in itsourcecode Online Admission System 1.0 in the confirm.php file. Manipulation of the ID argument allows remote attacks. The exploit has been publicly released.

The WP Statistics plugin for WordPress up to version 14.16.14 is vulnerable to Reflected Cross-Site Scripting via the REQUEST_URI query parameter key. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts.

The Repasat application has a Cross-Site Scripting vulnerability in the nomCompetidor parameter at the /es/competitors/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Download Manager plugin (up to version 3.3.71) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

The Advanced Ads plugin (up to version 2.0.26) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

The All in One SEO plugin for WordPress up to version 5.0.1.1 is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts. Exploitation requires the victim to have aioseo_manage_seo capability and open the SEO Preview panel.

The Repasat application has a Cross-Site Scripting vulnerability in the nomTipoCli parameter at the /es/clientypes/update/109441 endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomGrupoEmpresarial parameter at the /es/corporategroups/update/246 endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomMotivo parameter at the /es/lostmotives/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomServicioPrestado parameter at the /es/providedservices/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomDelegacion' at endpoint '/es/delegations/store'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomCompetidor' at endpoint '/es/competitors/store'.