CVE Vulnerability Catalog

In Apache Answer through 2.0.2, the question operation controller gates hide/show operations on the wrong permission check (unpin instead of hide). In custom role configurations separating these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.

In Apache Answer through 2.0.2, the importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path. Attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers, including privileged users, as stored XSS.

In Apache Answer through 2.0.2, full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.

MISP contains a vulnerability in the handling of module plugin settings. When rebuilding module-supplied settings for API consumption, the server drops the redacted and cli_only flags declared in the module's configuration metadata, potentially exposing sensitive credentials and bypassing access restrictions.

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree, bypassing the redaction check. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys; affects versions <2.5.48.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels without output encoding, allowing injection of arbitrary HTML or JavaScript.

MISP contains a CSS injection vulnerability in the remote event preview feature. The colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation, allowing injection of arbitrary CSS declarations.

A vulnerability was detected in NLP.js 4.27.0 affecting the Evaluator.walkFunction function in packages/evaluator/src/evaluator.js within the Condition Expression Pipeline component. Manipulating the condition argument results in code injection, and the attack can be launched remotely. The exploit is now public and the project has not yet responded to the issue report.

A vulnerability was determined in pi-agent-dashboard up to 0.8.0 in the WebSocket Gateway component, where manipulating the cwd argument leads to an origin validation error. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 0.9.0 (patch 48fd0bad5adfe76af9736599699d51a5f60019f6) fixes the issue.

A vulnerability was determined in DeepPavlov up to 1.7.0 affecting the MultiTaskPipelinePreprocessor.__init__ function in deeppavlov/models/preprocessors/multitask_preprocessor.py. Manipulating the preprocessor argument causes code injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the project has not yet responded to the issue report.

A deserialization of untrusted data vulnerability in the ExpressTech Quiz And Survey Master (quiz-master-next) plugin allows object injection. This issue affects Quiz And Survey Master from n/a through 11.2.7.

The Tutor LMS plugin up to version 4.1.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows a malicious script to be stored and executed in a user's browser.

The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.

The MapSVG plugin for WordPress (versions up to 8.16.1) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The Essential Addons for Elementor plugin up to version 6.8.5 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue stems from flawed privilege checks within the plugin component.

The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.

The Quiz Maker plugin by Ays Pro (versions up to 6.7.1.91) contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This may allow an attacker to inject malicious script.

In Apache Kylin from 4.0.0 through 5.0.4, an attacker with project admin permission may use a cache API to cause computed-column resource exhaustion. This is an allocation of resources without limits or throttling.

In Apache Kylin from 4.0.0 through 5.0.4, the default startup profile misses security settings. Any deployment with the security setting profile turned on is not impacted.

A vulnerability in Apache Kylin involving exposure of sensitive information to an unauthorized actor during job manipulation. It affects versions 4.0.0 through 5.0.4 and has minor impact unless job services are exposed to the public network.