CVE Vulnerability Catalog

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read. This allows users with contributor-level access and above to retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them.

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user. This allows someone who holds another member's in-flight payment identifier to delete that member's checkout state.

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, which happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions, can rewrite the saved field configuration of any form, including a live payment form.

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

A security flaw in JusticeRage Manalyze 1.0.0. The function PE::_parse_relocations in manape/pe.cpp of the PE Parser component is affected. Manipulating the BlockSize argument results in integer underflow. The attack requires local access. A patch named c372b6bbca9d8c63812be50596fefa4a79c65fd0 is recommended.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template renders user-controlled values without HTML escaping, allowing a project member to inject HTML into an approver's notification, enabling forged links, tracking content, or visually altered email content. Fixed in version 8.0.3.

wlc is a Weblate command-line client. Prior to 2.0.1, automatically discovered configuration can select the API URL while an unscoped API token is supplied without a matching URL. When wlc runs in an untrusted repository, it can send the token to an attacker-controlled URL. URL-scoped keys are not affected. Fixed in version 2.0.1.

A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/', the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

Dark Reader before version 4.9.126 (for Firefox) or 4.9.128 (for other browsers) allows a website to trigger a request to a locally running server through the image inversion pipeline when a resource uses a known public HTTPS URL and is detected as requiring inversion. This can cross the website-to-local-network boundary and disclose limited information about the resource.

hexpm (hex.pm) has a vulnerability of insufficient session expiration in OAuth tokens. A user whose organization membership or session has ended can still read the organization's private packages and documentation via a retained refresh token. Access is read-only and limited to organizations the account belonged to when the token was granted.

radare2 before version 6.2.0 has a vulnerability in the Mach-O LC_DATA_IN_CODE parser that trusts dataoff and datasize, potentially leading to a heap out-of-bounds read when processing a crafted file. The attack requires the bin.verbose option to be enabled. It may cause process termination, but no memory disclosure has been demonstrated.

radare2 before version 6.2.0 has a vulnerability in the Lua 5.3 bytecode function parser that reads fixed metadata fields without checking remaining buffer length. When opening a crafted file with a function name ending at the buffer boundary, the parser reads beyond allocated memory, possibly causing incorrect results or process termination.

radare2 before version 6.2.0 has a vulnerability in the binary property-list Unicode parser that underallocates memory and does not guarantee NUL termination. Running pFB or pFBj commands on untrusted data can cause out-of-bounds reads, leading to disclosure of uninitialized or adjacent heap contents in JSON output or process termination.

radare2 before version 6.2.0 has a vulnerability in the Mach-O Swift field-metadata parser where a relative pointer can be lower than the section base, leading to a negative index. When parsing metadata from a crafted file, the parser reads four bytes before the buffer, possibly causing incorrect processing or process termination.

Cloudreve before version 4.18.0 lacks the RequiredScopes(types.ScopeAdminWrite) middleware on tool.GET("wopi") and tool.POST("mail") routes, which inherit ScopeAdminRead. An OAuth application or API key with Admin.Read can probe configured WOPI endpoints and send arbitrary test emails via the server SMTP configuration, exceeding read-only authorization boundaries.

changedetection.io up to version 0.60.7 has a path traversal vulnerability in the static_content function in changedetectionio/flask_app.py in the Screenshot Handler component. Manipulating the filename argument allows a remote attack with high complexity and difficult exploitability. The exploit has been published, but the vendor did not respond.