CVE Vulnerability Catalog

An authorization bypass vulnerability in AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, leading to account takeover. A confirmation token issued for one user is accepted on another user's record.

The "Use of HTTP Request With Sensitive Query String" vulnerability in AshAuthenticationPhoenix causes a single-use sign-in token to be passed as a query parameter in the URL during login redirect. The token can be exposed in server logs, browser history, etc.

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an improper privilege management vulnerability. A low-privileged attacker with remote access could potentially exploit this to tamper with information and gain unauthorized access.

An improper authentication vulnerability in AshAuthentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user of a different resource. The issue arises from incorrect parsing of the sub claim in the JWT token.

The Xagio SEO plugin in versions up to and including 7.1.0.43 contains an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability. The lack of CSRF protection allows an attacker to force a logged-in user to perform unwanted actions.

The MC Woocommerce Wishlist plugin in versions up to and including 1.9.21 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

The PublishPress Series plugin in versions up to and including 3.1.3 contains an Administrator SQL Injection vulnerability. This enables an administrator-level user to inject malicious SQL code into database queries.

The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.

The SKT Addons for Elementor plugin in versions up to and including 4.0 contains an Editor SQL Injection vulnerability. This enables an editor-level user to inject malicious SQL code into database queries.

The WC Vendors Marketplace plugin in versions up to and including 2.7.2.1 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

The WordPress plugin WPMasterToolKit in versions up to 2.22.0 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Newsletters in versions up to 4.18 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin WP Maps in versions up to 4.9.9 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

The password reset functionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

The admin3 application through version 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

The admin3 application through version 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.