CVE Vulnerability Catalog

GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. A remote peer can write files outside the intended target directory using parent-directory components or absolute paths.

GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.

GitLab EE versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with developer-role permissions to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.

GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.

NLTK before 3.10.3 has a ReDoS vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regex patterns and executes them without validation, potentially causing catastrophic backtracking and blocking the Python process.

The Grav API plugin before 1.0.18 does not enforce API-key scope caps in the injectSecurityTab() function of BlueprintController. A caller with a scoped API key may see and potentially edit page permission fields beyond the granted scope.

The Greenshift – animation and page builder blocks plugin for WordPress up to version 12.8.9 has a Stored Cross-Site Scripting vulnerability in the customapi action handler. Insufficient sanitization of API responses before output via innerHTML allows authenticated attackers with Contributor-level access to inject arbitrary scripts.

The WP Data Access plugin for WordPress up to version 5.5.68 has an Insecure Direct Object Reference vulnerability in the check_app_access function. Missing validation on a user-controlled key allows unauthenticated attackers to access data from protected app containers.

The Reviews and Rating – Google Reviews plugin for WordPress up to version 5.10 has a Stored Cross-Site Scripting vulnerability in the wp_display() shortcode handler. Attackers with Contributor-level access can inject arbitrary scripts that execute when a page is accessed.

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure.

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix.

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.

The Simple Newsletter Plugin WordPress plugin before version 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record.

The RegistrationMagic WordPress plugin before version 6.0.9.4 does not sanitize and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it. This allows a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.