CVE Vulnerability Catalog

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2.

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the "open-cluster-management:subscription-admin" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation.

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster.

In Aerie/PlanDev sequencing-server, the authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.

In the Linux kernel, xfrm iptfs fails to propagate the SKBFL_SHARED_FRAG flag when copying fragments in iptfs_skb_add_frags(). If the source SKB has shared fragments, the new inner SKB may be incorrectly treated as having private fragments, leading to writes to memory still referenced by the outer SKB. The fix sets the flag in the loop after each fragment addition.

Stack-based buffer overflow vulnerability in Apache Lucy affects all versions. The project is retired and no fix will be released. Users are advised to find an alternative or restrict access to trusted users.

Deserialization of untrusted data vulnerability in Apache Lucy. The project is retired and no fix is planned. Users are advised to find an alternative or restrict access to trusted users.

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.

The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit OTP verification attempts or invalidate a one-time login code after a wrong guess. An unauthenticated user can request a login code for any account, and due to short numeric OTP, brute-force can lead to account takeover, including admin.

The Membership Plugin – Kadence Memberships for WordPress (up to version 4.0.0) is vulnerable to password reset link poisoning leading to account takeover. The legacy lost-password handler consumes the attacker-controlled rc_redirect parameter in two unvalidated sinks, allowing unauthenticated attackers to trigger password reset requests for any account (including administrators) and leak the reset key.

OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1 contains a buffer overflow in the construct_uri() function, which concatenates URI components into a fixed 1024-byte buffer without bounds checking. An attacker can control the username to overflow the buffer and overwrite adjacent global data, including the disable_503_translation flag, altering routing behavior.

OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check does not account for base64 expansion, allowing overflow of up to 21,844 bytes, overwriting adjacent transformation buffers.

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation. Attackers can use gadget chains such as SoapClient or Imagick for remote code execution.

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.