CVE Vulnerability Catalog

The Relevanssi plugin provides an Admin Search page that allows users with the `edit_posts` capability to run searches. The AJAX handler parses a user-controlled `args` parameter and passes taxonomy data to the restriction builder, where the value is not parameterized before being interpolated into a SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection.

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress up to version 1.17.4 is vulnerable to SQL Injection via the 'erpadvancefilter' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with CRM Agent role (or higher) to inject additional SQL queries and extract sensitive data from the database.

A vulnerability in Student-Registration-System 1.0 affects an unknown function in the file /student/changepass.php. Manipulating the oldpass argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33 in the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the Data Import Module. Manipulation of the argument filename causes server-side request forgery. The attack can be carried out remotely, and the exploit has been publicly disclosed. Upgrading to version 2.1.34 will fix this issue.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. It affects the function t5.l.c of the component com.zombodroid.MemeGenerator, leading to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI port, especially if not secured with TSIG, can send a specially crafted lease creation request with an overly long InfiniBand MAC address, triggering a buffer overflow in print_hw_addr(). Successful exploitation leads to persistent denial of service, crashing dhcpd and preventing restart without manual intervention.

RackTables up to 0.22.0 has a cross-site request forgery vulnerability. The attack can be performed remotely, and the exploit has been publicly disclosed. The project currently lacks CSRF protections.

A weakness in Ehco1996 django-sspanel up to 2023.12.26 affects the TicketDetailView function in apps/sspanel/views.py of the Support Ticket Handler component. Manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor did not respond. Only unsupported products are affected.

The SSRF vulnerability in Odysseus before commit 87babb5 allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

Ghost Admin from 2.2.0 to 6.54.1 did not invalidate existing sessions on login, which could have allowed session fixation attacks. Successful exploitation would have required another vulnerability on the same domain.

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBase and theme storage name handling.

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path separators in the caller-supplied filename. This issue is fixed in version 6.54.1.

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.

Ghost is a Node.js content management system. Prior to version 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack.

Ghost is a Node.js content management system. From version 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1.

Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.

A Cross Site Scripting vulnerability in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.

Baserow up to version 2.3.2 has a vulnerability in the verify function in views.py of the 2FA Verify Endpoint component, leading to improper authentication. The attack can be launched remotely but has high complexity. The issue is fixed in version 2.3.3.

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.