CVE Vulnerability Catalog

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read. Users with the contributor role and above could read the content of other users' draft, pending, scheduled and private posts and pages.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier exposed in public page source. Users with the Author role or above could overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

A vulnerability was determined in a2ui up to 0.10.6 affecting the formatString function in expression_parser.ts of the Parser component. The manipulation causes resource consumption and can be initiated remotely. The exploit has been publicly disclosed and a patch is available as 1f71d1aac1b145ef57c7526f9e0cff316f5934e2.

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The SMS dialplan application must be explicitly used and input not validated.

pageant versions 0.2.0 through 0.2.5 trust a peer-controlled four-byte length prefix and buffer until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This is fixed in version 0.2.5.

russh before 0.65.0 in russh::keys::agent::server::serve accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This is fixed in version 0.65.0.

In CKEditor 5 from 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.

Response body and chunk parsing would handle non-hex or negative integers incorrectly, which could result in misinterpreting HTTP response contents. This may cause incorrect data processing by the HTTP client.

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. The flaw involves improper memory management within this component.

Tanium addressed an infinite loop vulnerability in the Threat Response Client Extension.

Tanium addressed an information disclosure vulnerability in the Threat Response Client Extension.

Tanium addressed an insufficient logging vulnerability in Tanium Server.

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user granted only read-data access could call the endpoint directly to enumerate everyone the table is shared with and their access levels.

A public shared collective always allowed recipients of the link to create pages.

A missing token type check allowed retrieving additional information about the WOPI configuration with a user or guest token.

In Asterisk, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.

In Asterisk, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.