CVE Vulnerability Catalog

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before version 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

The Food Menu WordPress plugin before version 6.0.2 does not perform any capability or ownership check on its reservation-status update action. This action is exposed to unauthenticated users and protected only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

VoiceTra by NICT contains a vulnerability due to an incorrectly specified destination in a communication channel. Users may be redirected to an attacker-controlled server, potentially leading to theft of input data or display of incorrect results.

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE_READONLY, to modify alarm state despite the read-only restriction. A credential check is guarded by an inverted condition, so it never executes for a real (non-blank) username.

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 DHCP parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing.

A vulnerability in Palo Alto Networks Prisma Access Agent on Windows allows a local attacker with administrator privileges to bypass anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser enables a local attacker to view sensitive data.

A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser enables a user to bypass intended security controls.

In NortheBridge/luminalshine, a Sunshine-compatible game stream host for Moonlight, prior to version 26.05.0-rc4, a latent gap exists on a default install, but under certain conditions may lead to privilege escalation. Version 26.05.0-rc4 contains a patch.

The Meeting Room Booking System (MRBS) prior to version 1.12.2 contains an open redirect vulnerability that allows an unauthenticated attacker to redirect users to an arbitrary location after clicking a specially crafted URL. Version 1.12.2 contains a fix.

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. Values beginning or ending with a pipe (|) are executed as commands, and those with a redirect (>) open the path for write or append.

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests with an empty Referer value or omitting the header entirely may be accepted due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

IBM DataPower Gateway versions 11.0.0.0-11.0.0.1, 10.5.0.0-10.5.0.21, and 10.6.0.0-10.6.0.9 have a race condition that results in improper isolation of request state when handling the built-in X-Client-IP header. Under concurrent request processing, X-Client-IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients' IP addresses.

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.

In vinny/views.py, the ModifyEmailNotifications function has an IDOR vulnerability: it fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking if the record's contact belongs to the requesting group-admin. This lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.