CVE Vulnerability Catalog

In Copernik XML Factory (secure-by-default JAXP factory creation for Java) before 0.1.2, XInclude resource resolution is not blocked on the stock JDK provider when an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). Parsing untrusted XML can disclose local files or, via http references, reach internal network endpoints through SSRF.

In AdminNeo (a PHP database management tool) versions 4.6.2 through 5.4.x, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF, or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache, and design.inc.php later passes that value to cookie() and rawurlencode(), causing a TypeError. An attacker can make the instance return HTTP 500 to all users for the cache's 24-hour lifetime or until the poisoned cache is removed.

The Profile Builder plugin in versions up to 4.0.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.

The Profile Builder plugin in versions up to 4.0.5 contains a privilege escalation vulnerability allowing a Contributor-role user to elevate privileges. This may grant access to functionality reserved for higher roles.

The Booking and Rental Manager plugin in versions up to 2.8.2 contains a Broken Access Control vulnerability allowing a Subscriber-role user to perform unauthorized actions. This may lead to bypassing access controls on plugin functionality.

The GIFTiT – Free Gifts for WooCommerce plugin in versions up to 4.5 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This may allow code injection into a web page.

The Fast Velocity Minify plugin in versions up to 3.5.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.

In OpenAM before 16.1.1, the RADIUS authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 Response Authenticator; the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so an attacker can race the real server or spray forged Access-Accept packets and obtain a session for any RADIUS-mapped username without knowing the shared secret.

The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The Ultimate Addons for Elementor - Lite plugin in versions up to 2.9.5 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This may allow persistent injection of malicious script.

The WordPress plugin FunnelKit Automations (wp-marketing-automations) up to version 3.8.6.1 contains a deserialization of untrusted data vulnerability that allows object injection. This may let an attacker perform dangerous operations.

The WordPress plugin WP EasyPay in versions up to 4.5.4 contains an unauthenticated Path Traversal vulnerability. An unauthenticated attacker can access files outside the intended directory.

The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.

The VikRentCar plugin (e4jvikwp) through version 1.4.10 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in a user's browser.

The User Registration plugin in versions up to 5.3.0 contains a Cross Site Scripting (XSS) vulnerability allowing a Subscriber-role user to inject malicious script. This may lead to code execution in other users' browsers.

Nezha versions 2.0.0 before 2.4.0 contain a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats. An authenticated user can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

NodeBB versions 1.18.0 through 4.16.5 contain an authorization bypass vulnerability allowing unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.

GStreamer's gst-plugins-base MicroDVD subtitle parser contains a NULL pointer dereference flaw. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

In the H.264 video parser in gst-plugins-bad, when processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.