CVE Vulnerability Catalog

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files. It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This allows an attacker to repeatedly attempt password guesses for a user account without adequate restrictions.

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the update_license AJAX action in all versions up to and including 5.2.0 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages.

WebITR developed by Uniong has an insecure deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

A DOM-based cross-site scripting (XSS) vulnerability in LIFF SDK versions 2.20.0 through 2.31.0 allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of authentication tokens or application data, or unauthorized actions using the user's session.

In fast-uri (a Node.js URI parser) before 2.4.8, 3.0.0–3.1.8, and 4.0.0–4.2.2, serialize(), normalize(), or resolve() with the non-default suffix option on a reference without authority can emit a relative reference with an unescaped bare colon in its first path segment. This can cause the string to reparse as an absolute URI with a scheme such as javascript:, data:, or vbscript:.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme, producing a stored or reflected cross-site scripting vector. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten. This can bypass host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

In fast-uri (a Node.js URI parser) before 2.4.8, 3.0.0–3.1.8, and 4.0.0–4.2.2, normalize() and serialize() apply RFC 3986 dot-segment removal to the path of a relative-path reference, although that algorithm is defined only for the merged target path during resolution. As a result, a leading parent-directory segment can be dropped and a document-relative reference can become root-relative.

Hidden functionality issue exists in multiple DVRs provided by Atsumi Electric Co., Ltd. A user who can log in to the product with administrator privilege may execute arbitrary OS commands.

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Hidden functionality exists in multiple DVRs provided by Atsumi Electric Co., Ltd. A user who can log in with administrator privileges may upgrade the affected product to unauthorized firmware.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by IMAP command injection. A remote authenticated attacker can exploit CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.