CVE Vulnerability Catalog

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.

Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service 9.23 and prior allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint. No fixed version is available.

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

The YITH WooCommerce Wishlist plugin up to version 4.18.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving SQL injection in dodelete.php of the Registration-Delete Handler component. Manipulating the ID argument enables remote attack and the exploit is publicly available.

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving SQL injection in the mysqli_query function of doedit.php in the Registration-Edit Handler component. Manipulating the id/name/title/year/gender/fromdate/todate/people arguments enables remote attack and the exploit is publicly disclosed.

The YITH WooCommerce Product Bundles plugin up to version 2.29.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

The Broadcast Live Video plugin up to version 7.3.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.

The FluentCommunity plugin up to version 2.11.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

The FluentForm plugin up to version 6.2.15 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may access functions requiring privileges.

The JetElements For Elementor plugin up to version 2.9.2.4 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

The e2pdf plugin up to version 1.32.57 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.

The LearnPress plugin up to version 4.4.10 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions requiring higher privileges.

In Red Hat Advanced Cluster Security for Kubernetes (RHACS), the Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Deserialization of untrusted data vulnerability in the Apache Camel Camel-Jgroups component. The JGroups consumer receives messages over the default UDP multicast stack without authentication and without a deserialization filter, allowing a remote host on an adjacent network to send a crafted object and achieve remote code execution if a usable gadget chain is present on the classpath.

A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used.

A vulnerability was found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 involving SQL injection in admindocview.php of the Administrative Mutation Handler component. Manipulating the docid argument enables remote attack and the exploit is publicly disclosed.

In the dmCodeEditor component of diem-project diem up to 5.1.3, the dmOs::join function in actions.class.php allows manipulation leading to path traversal. The attack can be launched remotely and a public exploit is already available.

In fastllm up to 0.1.8.2, the GGUFBuffer::ReadString function in gguf.cpp mishandles the len argument, causing a buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.