CVE Vulnerability Catalog

An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables. When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.

A flaw in the Device Authorization Grant flow of Keycloak occurs because the token redemption process fails to check whether a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens.

A flaw in the skupper-router component of Red Hat Service Interconnect occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash.

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input. Users with a role as low as contributor can modify arbitrary WordPress options, which can be used to deactivate the Notiqoo plugin before 1.4.14 and to lock every administrator out of the site.

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM).

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data.

An information disclosure vulnerability in the Palo Alto Networks Prisma Access Agent on Linux enables a local user to access sensitive configuration data and credentials.

An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts. This occupies a shared broker thread and leads to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

When the broker processes message-based management requests sent by an authenticated messaging client authorized with MANAGE permission, parameter processing can trigger Java deserialization of certain method parameters the broker will not use. The permitted types allow crafting a payload that causes excessive computation and pins the processing thread, leading to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.3.0 through 2.44.0.

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to and including 2.0.4. The plugin registers this field with show_in_rest enabled but without a sanitize_callback, and outputs unsanitized data directly into <style> tags on the frontend.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with custom-level access or above to import forged CSV submission records into any Contact Form 7 form.

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.1.0 via the 'backup_file' parameter. An authenticated attacker with administrator-level access or above can read arbitrary files on the server, including sensitive information.

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to and including 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without capability or nonce verification, and the post_id is sourced directly from user input.

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Photo Module 'attributes' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'bg_video_service_url' setting in all versions up to and including 3.0.2 due to insufficient input sanitization and output escaping.