CVE Vulnerability Catalog

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing a stream object because the stream length is taken from its own dictionary and not checked against the actual number of bytes present. In fixed versions, the declared length is clamped to the bytes actually read.

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing an encrypted document because the decryption key length is taken from the document's encryption dictionary and used to fill a fixed-size key buffer without being checked. In fixed versions, a declared key length larger than the buffer is rejected.

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow exists when importing a text record that carries its own character advance widths because the count of advance values and the text length are read separately and not required to agree. In fixed versions, an advance array shorter than its text is ignored.

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope, allowing an attacker to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

In Checkmk versions <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL), insufficiently protected credentials in host and folder configuration endpoints of the REST API allow an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

Memory corruption while processing a crafted ELF file in the Primary Bootloader.

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 6.6.43 via the 'provider' parameter. An authenticated attacker with shop manager-level access or above can delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls.

The WP-CRM System plugin for WordPress in versions up to and including 3.4.6 is vulnerable to Sensitive Information Exposure via the 'contact_id' parameter. An authenticated attacker with contributor-level access or higher can enumerate this parameter to extract CRM contact data such as full names, email addresses, phone, mobile and fax numbers, and physical addresses.

A flaw was found in the Kerberos federation provider of Keycloak. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC), allowing an attacker on the same network to spoof the KDC and bypass authentication.

The wpForo Forum plugin for WordPress in versions up to and including 3.1.5 is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can take over another guest author's forum post and modify its title, body, author name, and stored owner email address.

The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.

The RW Elephant Rental Inventory plugin for WordPress in versions up to and including 2.3.13 is vulnerable to Missing Authorization due to a missing capability check on the toggle_cache() function hooked to the wp_ajax_toggle_cache AJAX action. An authenticated attacker with Subscriber-level access or higher can toggle the plugin's cache setting by sending a POST request to admin-ajax.

The Hostel plugin for WordPress in versions up to and including 1.1.8 is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting due to insufficient input sanitization and output escaping. An authenticated attacker with Administrator-level access can inject arbitrary web scripts into pages that execute when a user visits the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The Tutor LMS plugin for WordPress in versions up to and including 4.0.7 is vulnerable to Insecure Direct Object Reference via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values belong to a quiz/topic/course the requester is authorized to manage. An authenticated attacker with Instructor-level access or higher can overwrite content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and delete arbitrary quiz question and answer rows.

The WP User Manager plugin for WordPress in versions up to and including 2.9.18 is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function. The function is registered on the admin_init hook and performs no current_user_can() or nonce verification before fetching Stripe credentials and writing them into the wpum_settings option. An authenticated attacker with Subscriber-level access or higher can hijack the site's Stripe integration, routing all payments to their own Stripe account.

The Live Composer plugin for WordPress in versions up to and including 2.1.21 is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Custom Field Template plugin for WordPress in versions up to and including 2.7.8 is vulnerable to Insecure Direct Object Reference via edit_meta_value due to missing validation on a user-controlled key. An authenticated attacker with contributor-level access or higher can delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages.

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.