CVE Vulnerability Catalog

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to and including 4.3.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Improper privilege management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit allows privilege escalation and parameter injection. A local user with command line access may escalate privileges by abusing parameters of a command approved in the sudoers file. Affects versions A33.10, A33.20, and A33.30.

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This affects NanoXML version 2.2.3.

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this SSRF to read responses from internal network addresses, including cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist is not consulted. Fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.

Several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements outside their permitted range. Exploitation requires a low-privileged backend user account. Affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34, and 14.0.0-14.3.6.

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs where log redaction did not cover all affected paths and data types. An attacker with read access to the log destination could obtain credentials and decryption keys that, if still valid, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Fixes are available in specific driver versions and require manual upgrade.

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross-site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

The Product Catalog Enquiry for WooCommerce by MultiVendorX plugin (versions up to and including 6.1.5) has an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation.

A vulnerability in code-projects Student Crud Operation 1.0 affects an unknown function of the file /card_activation.sql in the Backup File Handler component. Manipulation leads to information disclosure. The attack can be launched remotely, and the exploit has been made public.

A vulnerability in code-projects Student Crud Operation 1.0 affects an unknown function of the file /edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed publicly.

A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.

A vulnerability in elenavanengelenmaslova mocknest-serverless 0.9.0 affects an unknown function of the file deployment/aws/shared/github-oidc-role.yaml in the AWS GitHub OIDC Deployment Helper Script component. Manipulation leads to improper privilege management. The attack can be initiated remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b.

A vulnerability in vgmstream up to r2117 affects the add_entry function in src/meta/txtp_parser.c in the txtp component. Manipulation of range_start/range_end arguments leads to resource consumption. The attack can be performed remotely, and the exploit has been disclosed publicly. The patch is named 4b6a02dd1aff6428255db912563d77d4cb0a143e.

A weakness in vgmstream up to r2117 affects the sscanf function in src/meta/txth.c in the txth-txtp component. This manipulation causes stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public. Patch name: 4669d37a6af94866f6f0628678f9f90d46954e8b.