CVE Vulnerability Catalog

HmacShaCryptor.Hash never hashed its input — for any input it returned HMAC_K(""), the MAC of the empty message under the key. As a result, every AES-CBC-HMAC JWE produced or verified by gose carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

The BlueSpiceUserManager extension in BlueSpice lacks authorization checks in the REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete. Any authenticated user without special privileges can block or unblock arbitrary accounts, including administrators.

QXmlStreamReader can consume disproportionate CPU during parsing of a crafted XML document, causing the application to become unresponsive (denial of service). Exploitation only requires the application to parse attacker-influenced XML; no authentication or user interaction is needed.

The VikRentCar plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script stored in the application is later executed in users' browsers.

The GamiPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker can inject their own queries into the database.

The VikRentCar plugin contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is reflected in the server response and executed in the victim's browser.

The WPMobile.App plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. Unauthorized parties may access functions or resources that should be protected.

The rsyncd service of CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted solely based on the client's source IP address, so an attacker able to spoof an allowed IP can edit files on the affected system.

The CGM CLININET application stores user passwords as unsalted MD5 hashes. This storage method is vulnerable to dictionary and rainbow table attacks in the event of a database breach.

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of evaluated code, an authenticated high-privileged attacker can cause arbitrary code execution with root privileges.

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker on the adjacent network to retrieve the list of patient documents and download them.

Improper authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.

Improper neutralization of special elements used in an OS command (OS command injection) and cross-site request forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges.

Improper neutralization of special elements used in an OS command in certain ASUS routers allows a remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not consistently resolve the target of the update-user action between authorization and execution in its front-end Forms module. This allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account, and obtain a valid session. Exploitation requires two separate front-end form configurations whose targets are mapped to visitor-submitted values.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only for administrator accounts. This allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires a published form whose user-update action maps its target to a visitor-submitted value.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator.

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form. This allows a Multisite subsite Administrator to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.