CVE Vulnerability Catalog

A reflected cross-site scripting (XSS) vulnerability in PHP Jabbers - PHP Poll Script allows an attacker to craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1.

A Cross-Site Request Forgery (CSRF) vulnerability in multiple PHP Jabbers scripts allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

In Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2, the classic I/O-based HTTP client fails to properly release connections back to the connection manager when encountering an invalid or unsupported Content-Encoding header value. This defect does not affect the async I/O model.

In Apache Zeppelin versions 0.9.0 through 0.12.0, when FileSystemNotebookRepo is configured, an authenticated attacker with rename or folder operation permissions can use traversal segments in note or folder paths. Zeppelin composes these into filesystem paths without ensuring they remain under the configured notebook directory, potentially allowing file move, write, or delete outside the notebook root.

The Fluent Forms plugin for WordPress up to version 6.2.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'transaction' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email, billing address, order items, payment method, and payment status of other users.

The MailerPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access due to a missing capability check on the REST API endpoint `mailerpress/v1/contact`. This allows unauthenticated attackers to update contact details.

The MailPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access in the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). The route was registered without a permissionCallback, allowing unauthenticated attackers to run the restoreRevision() handler and overwrite campaign content with any prior revision.

The HTTP server in ANDRITZ HIPASE-250 (formerly 250 SCALA) exposes an undocumented endpoint that changes logging level and target without authentication. A remote, unauthenticated attacker can suppress audit logging, potentially concealing other activity on the system.

In the TokenManager component of Keycloak, an administrator attempting to revoke tokens for a specific application using a "not-before" policy may have the revocation silently ignored if the realm already has an older, non-zero revocation policy. This can allow previously issued tokens to remain valid for session refresh and data access.

In Keycloak, the token exchange feature does not enforce organization (tenant) restrictions when logging in via Microsoft. An attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.

In Keycloak, the token exchange feature does not enforce Google Workspace domain restrictions when logging in via Google. An attacker with a valid Google account from a different domain can bypass security checks and gain access to the Keycloak realm.

In the secure-client-uris component of Keycloak, URL validation only checks the start of the address rather than properly verifying the host. An attacker can bypass security restrictions requiring encrypted connections for redirect URIs by using a specially crafted domain name, potentially allowing interception of authentication codes over unencrypted connections.

In the OIDC token introspection endpoint of keycloak-services, a confidential client configured to receive signed JWT responses may receive the full set of token claims in a signed JWT field even if the token was issued for a different audience. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information.

In Keycloak, the group policy evaluation logic uses a simple text-based prefix check to verify group membership instead of exact matching. A user belonging to a group with a similar starting name can bypass security checks and gain unauthorized access to administrative functions or protected resources.

In the RoleContainerResource component of Keycloak, name-based admin REST API endpoints do not properly enforce authorization checks when managing composite roles. A delegated administrator with manage-realm permissions can remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

The BuddyPress WordPress plugin before version 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

The JS Help Desk WordPress plugin before version 3.1.4 does not verify ownership of a reply before updating it. Any authenticated user (Subscriber and above) can overwrite the content of any support-ticket reply.

The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks when returning ticket content in a nonce-gated search handler. Any authenticated user (Subscriber and above) can read the subject and full message body of all other users' support tickets.