CVE Vulnerability Catalog

The WP-Stateless plugin in versions up to 4.4.1 contains a Settings Change vulnerability. An attacker with subscriber privileges can change plugin settings.

The WP Swings Return Refund and Exchange For WooCommerce plugin through version 4.6.4 contains a missing authorization vulnerability. Incorrectly configured access control security levels can be exploited.

The WP Travel plugin for WordPress (up to version 12.0.3) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows password recovery exploitation. An attacker can reset a victim's password without their knowledge.

The Page Visits Counter – Lite plugin in versions up to 1.2.3 contains a Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script.

The Shirt Product Designer for WooCommerce plugin in version 1.0.4 contains a broken access control flaw that allows an unauthenticated attacker to perform operations they should not be authorized to do.

The Advanced Product Fields Extended for WooCommerce plugin by Studio Wombat up to version 3.1.6 contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory. This allows an attacker to manipulate file paths.

The Thank You Page Customizer for WooCommerce plugin in versions up to and including 1.2.2 contains a broken access control flaw that allows an unauthenticated attacker to perform unauthorized operations.

A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.

The MailMunch – Grow your Email List plugin in versions up to and including 3.2.5 contains a broken authentication flaw that allows a subscriber-level user to bypass access controls.

Suricata is a network IDS, IPS, and network security monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio (e.g., gzip, deflate, brotli) could cause excessive memory allocation during decompression.

Suricata is a network IDS, IPS, and network security monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service.

MISP in versions up to and including 2.5.45 does not consistently enforce the acting user's authorization when instantiating event templates. The instantiation path passed a template-specified sharing_group_id into event creation without verifying the user could use that sharing group, attached template-specified tags without checking tagging permissions, and hardcoded local => 0, allowing local_only tags to be attached globally and propagate through synchronization or export.

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. An attacker who obtains an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls, allowing unauthenticated callers with a share link to retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions.

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules.

OpenPanel through 2.3.0 has an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII.

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry. A malicious or compromised container registry can therefore specify a Link header pointing to an attacker-controlled host and receive the credentials Renovate uses for that registry. Exploitation requires that the target has container (Docker) dependencies and is already interacting with the malicious or compromised registry. This is fixed in Renovate 44.11.2 (npm and renovate/renovate images), Mend Renovate CE/EE 15.4.0 and the mend-renovate-enterprise-edition Helm chart 10.4.0; the same-origin check can be disabled with RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN.

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions=['gradleWrapper', ...], a repository that supplies a crafted distributionUrl (for example, appending a shell metacharacter and command) can cause arbitrary commands to be executed as the Renovate user when Renovate processes a Gradle Wrapper update. The issue is fixed in Renovate 44.14.7; as a workaround, remove 'gradleWrapper' from allowedUnsafeExecutions.