CVE Vulnerability Catalog

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL.

Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log out from your IdP" action is subsequently triggered, the wapptunneld service processes the poisoned interface name, leading to the execution of arbitrary commands with root privileges.

An Improper Access Control vulnerability in UniFi Protect AI Key allows a malicious actor with network access, under certain conditions, to reach internal resources through the device.

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

An Improper Access Control vulnerability in UniFi Protect AI Key allows a malicious actor with network access to reach internal resources through the device.

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer, even though it should be root ownership.

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.

NetBird client versions 0.60.0 through 0.74.6 contain a command injection vulnerability allowing a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts due to improper escaping of peer names in SSH configuration.

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to and including 4.5 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages that execute in an administrator's browser when the GetSocial settings page is visited.

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to and including 1.5.0 due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with Subscriber-level access and above can append additional SQL queries to extract sensitive information from the database.

The NewStatPress plugin for WordPress up to version 1.4.5 is vulnerable to Stored Cross-Site Scripting via the 'Last referrers' meta box on the Overview admin page due to insufficient output escaping, allowing unauthenticated attackers to inject arbitrary scripts.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.16.1 via the 'args[link_target]' parameter. Unauthenticated attackers can extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1.

The FV Flowplayer Video Player plugin for WordPress up to version 7.5.54.7212 is vulnerable to Stored Cross-Site Scripting via the 'synopsis' shortcode attribute due to insufficient input sanitization and output escaping, requiring the 'Parse Vimeo and YouTube links' option enabled and liststyle set to 'season'.

The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to and including 1.4.2 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Gmedia Photo Gallery plugin for WordPress up to version 1.25.1 is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Smart Forms plugin for WordPress up to version 2.6.104 is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to blind SQL Injection via the 'inputs' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.