CVE Vulnerability Catalog

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress up to version 1.9.15 is vulnerable to unauthorized data access due to improper capability check on the can_access function. Authenticated attackers with Contributor-level access can retrieve a master-password and access any password-protected content.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant from n/a through 3.39.

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing from n/a through 5.2.30.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.

Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.

Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.

Cross-site Scripting (XSS) vulnerability in the Draft List plugin (simple-draft-list) allows stored XSS. Versions up to 2.6.4 are affected.

Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.

Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.

Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.

Vulnerability in 4gaBoards (before 3.3.9) allows any authenticated user to enumerate accounts and read data of all users via the /api/users API, without authorization.

Vulnerability in Streambert (from 2.5.0 to 2.6.0) allows script injection in the Wyzie key redemption window, which removes the CSP header and lacks window open restrictions, enabling malicious script execution in the application context.

Vulnerability in CefSharp (before 148.0.90) allows reading files outside the configured directory via FolderSchemeHandlerFactory, which uses an incorrect path prefix comparison, enabling access to files in similarly named directories.

Vulnerability in Confidential Containers Guest Components (from 0.16.0 to 0.20.0) allows creating a hardlink outside the destination directory via a crafted OCI image layer, potentially leading to writing data outside the pod VM.

Tapo C200 v5 has an improper input validation vulnerability in the configuration service for processing encrypted credential data. An attacker can send oversized ciphertext values that may trigger exception handling failures, causing the device to crash or restart.

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Incorrect reference resolution in Core in Google Chrome on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.

Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) in versions 4.0.0-4.5.2. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to cause a partial denial of service (partial DoS) of Helidon. CVSS 5.3 (Availability impact).

Vulnerability in Oracle Fusion Middleware Helidon product (component: Imperative Web Server) affecting versions 3.0.0-3.2.17. A low privileged attacker with network access via HTTP can exploit this. Successful attacks can result in unauthorized update, insert, or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of that data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).