CVE Vulnerability Catalog

The AFFI – Affiliate Marketing for WooCommerce plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 1.0.9. Incorrectly configured access control levels may allow unauthorized users to perform operations they are not permitted to.

The Majestic Support plugin for WordPress contains an Authorization Bypass Through User-Controlled Key vulnerability in versions up to and including 1.2.0. Incorrectly configured access control levels may allow unauthorized access to resources.

The Majestic Support plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 1.2.0. Incorrectly configured access control levels may allow unauthorized users to perform operations they are not permitted to.

Apache APISIX versions 3.12.0 through 3.18.0 contain an improper authentication vulnerability in the openid-connect plugin. A token that is active for one issuer may be accepted on a route restricted to another issuer when remote introspection is used.

Apache APISIX versions 2.14.1 through 3.18.0 contain a vulnerability in the use of non-canonical URL paths for authorization decisions. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover, allowing unauthenticated access.

Apache APISIX versions 3.17.0 through 3.18.0 contain an improper verification of cryptographic signature vulnerability in the saml-auth plugin. An unauthenticated attacker can impersonate any user on routes protected by this plugin under default configuration.

MISP before version 2.5.48 contains an incomplete authorization check in the discussion posting functionality. An authenticated user outside the sharing group or without visibility on the associated event can read the thread title and quoted post content, and submit new posts into the thread, to which they are not authorized.

ansible-runner contains a vulnerability in the unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the transmit/worker protocol. The function re-creates symbolic links without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive can create files, symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.

A flaw was found in the tnef library involving improper memory management when processing specially crafted TNEF files with multiple message bodies. This leads to use-after-free and double-free conditions, causing the application to crash and resulting in a Denial of Service (DoS).

A flaw was found in the tnef library due to improper validation of input buffer boundaries before copying data in get_rtf_data_from_buf(). A specially crafted file with uncompressed RTF data can cause reading beyond allocated memory, leading to a crash (DoS) or leaking sensitive memory contents into extracted output files.

The WP Ultimate CSV Importer plugin by Smackcoders Inc. contains a vulnerability involving insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This issue affects versions from n/a through 9.1.

Vulnerability in Apache APISIX exposing data to the wrong session. Under certain authz-keycloak configurations, a request's authorization scope may persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Affects versions from 2.3.0 before 3.7.0.

A vulnerability in Apache APISIX 3.17.0 causes unmasked header values to be written to the log sink under a certain response structure. The issue is fixed in version 3.18.0.

A vulnerability in FluentForm (WordPress plugin) up to version 6.2.14 inclusive causes incorrect behavior order, allowing removal of important client functionality. The issue affects versions from n/a through 6.2.14.

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching, allowing authenticated staff users to trigger outbound HTTP requests to arbitrary URLs, including internal network endpoints.

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data.

Ghost from 5.9.0 before 6.44.1 contains an input validation flaw in the comment like feature. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorization bypass and unauthorized modification of comment engagement data.

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without proper authorization checks.

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create duplicate user accounts.