CVE Vulnerability Catalog

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It impacts read_metadata_from_safetensors in modules/sd_models.py of the Metadata Extraction component. Manipulating the header length field results in resource allocation, the attack can be launched remotely, and the exploit has been made public. The project was informed but has not responded yet.

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It affects create_item_html in modules/ui_extra_networks.py of the Card Builder component. Manipulating the filename argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The project was informed but has not responded yet.

The PowerPack Lite for Beaver Builder plugin (up to version 1.3.1) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.

The Support Genix plugin (up to version 1.4.54) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.

The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.

The 2Way VideoCalls and Random Chat plugin (up to version 6.1.5) contains an Authentication Bypass by Primary Weakness vulnerability, allowing Authentication Abuse. An attacker can gain access to functions restricted to logged-in users.

The Kit (formerly ConvertKit) plugin for WordPress (up to version 3.4.6) has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can perform operations they are not authorized to do.

The Electronic Signature Add-on for Fluent Forms plugin (up to version 2.0.5) has an authorization bypass through user-controlled key vulnerability. This allows exploiting incorrectly configured access control security levels.

The Simply Schedule Appointments plugin (up to version 1.6.12.35) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.

The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

The Advanced File Manager plugin for WordPress (up to version 5.4.14) has a Missing Authorization vulnerability, enabling exploitation of incorrectly configured access control security levels. An attacker can access file management functions without proper permissions.

The Booktics plugin (up to version 1.0.29) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets executed in the victim's browser.

The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

The eStore plugin for WordPress (up to version 1.6.13) is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious JavaScript that executes in the victim's browser.

The Strong Testimonials plugin for WordPress (up to version 3.3.12) is vulnerable to deserialization of untrusted data, allowing Object Injection. An attacker can supply malicious data that gets deserialized by the application.

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement. This allows authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.