CVE Vulnerability Catalog

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page. This allows attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

The Timetics WordPress plugin through version 1.0.61 does not enforce per-object ownership when updating appointments via its REST API, allowing users with the custom staff role to modify, disable, or take over appointments belonging to other staff members.

The Icegram Express WordPress plugin before version 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

The Weaver Show Posts WordPress plugin before version 1.8.1 unserializes the content of an imported file, which could lead to PHP object injection issues when a high privilege user imports a malicious file and a suitable gadget chain is present on the blog.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions from 0.0.0 to 1.0.2.

Privilege defined with unsafe actions in Drupal Content Moderation Notifications allows privilege escalation. Affects versions from 0.0.0 to 3.9.0.

Observable timing discrepancy in Drupal Commerce CyberSource allows brute force attacks. Affects versions from 0.0.0 to 1.10.0.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

The Rank Math SEO WordPress plugin before version 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata. This allows users with the Author role and above to read the title, body, and metadata of other users' non-public posts.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata. This allows users with the Author role and above to alter that metadata on content, taxonomy terms, and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.

The Rank Math SEO WordPress plugin before version 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable. This allows unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled, and password-protected posts.

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.