CVE Vulnerability Catalog

In OpenAM prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. A crafted project can inject and execute arbitrary operating system commands through the unit test execution flow. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution.

In affected versions of MISP, a collection element can be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The add() path could persist a UUID for an Event or Galaxy Cluster that the caller could not normally read, making collections a way to reference another organisation's private data. The fix centralizes authorization in __assertCanUseElements(). Affected versions: ≤2.5.45.

In affected versions of MISP, a submitted sharing group is not authorized in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4; omitting distribution while supplying a different sharing_group_id skipped that check, and field-recovery logic restored the existing event distribution. The fix adds authorization checks in the controller and Event::_edit(). Affected versions: ≤2.5.45.

A hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. It requires SSH login and enable mode access.

An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands. It requires access to the NETCONF interface.

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file. It requires local access to the machine.

A privilege escalation flaw exists in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs mysqld --validate-config --log-error-verbosity=2 directly as root, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql, setting plugin_dir and early_plugin_load so MySQL loads the attacker-controlled object during configuration validation. When an administrator subsequently runs the Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t).

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker, including the built-in worker. Incorrect permission validation during script execution allowed the script to run without the user having the required authorization.

In GPAC up to f1219cde, a flaw in the function gf_mo_get_od_id in compositor/media_object.c of the Compositor component can lead to use-after-free. The attack can be performed remotely, and the exploit has been published. Upgrading to version abi-16.24 resolves the issue.

The Eventin plugin for WordPress up to version 4.1.23 is vulnerable to privilege escalation. The PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter and unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping to plugin-specific capabilities. This allows authenticated attackers with user ID 1, even subscribers, to pass every WordPress capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, leading to full site takeover and remote code execution. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.

In SourceCodester Online Faculty Clearance System 1.0, a SQL injection vulnerability exists in an unknown function of the file /delete_faculty1.php, through manipulation of the ID argument. The attack can be executed remotely, and the exploit has been disclosed publicly.

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in SQL injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown function in the signup.php file of the Registration Flow component. Manipulation of the role argument leads to improper privilege management. The attack can be launched remotely, and the exploit has been publicly disclosed.

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. It affects an unknown function in the /web/order.php file. Manipulation of the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. It affects an unknown function in the /web/category-foods.php file. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.