CVE Vulnerability Catalog

OpenStack Horizon before version 25.7.4 produces scripts for downloading OpenStack RC files that may contain a crafted project name with shell metacharacters.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. Attackers can send crafted requests, leading to a heap buffer over-read in the NGINX worker process, potentially resulting in limited memory disclosure or a restart.

The DroneAware drone detection platform was vulnerable to an account pre-hijacking attack where an attacker could register an account using a victim's email address with an attacker-controlled password before the victim activated the account. Once the legitimate owner activated the account, the attacker-set password became valid, allowing silent account takeover without victim notification.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain a vulnerability related to the use of a broken or risky cryptographic algorithm. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and information tampering.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Access Control vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI string can trigger heap-buffer-overflow writes and reads during ACI parsing due to insufficient validation of keyword length after whitespace stripping.

Plane CE version 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake.

Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to man-in-the-middle attack in tandem with DNS cache poisoning.

The NewsItemApiController in SimplCommerce prior to commit 6233d73e is vulnerable to cross-site request forgery (CSRF), allowing an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.

A vulnerability in the FluxBuilder MStore API allows authentication bypass via an alternate path or channel, enabling password recovery exploitation.

In WorkScout-Core versions up to 1.7.11, there is a vulnerability allowing unauthenticated arbitrary file deletion.

In School Management versions <= 93.1.0, there is a vulnerability of unauthenticated insecure direct object references (IDOR). This allows attackers to access data they should not have access to.

The myCred plugin for WordPress, responsible for points management in loyalty programs, is vulnerable to Stored Cross-Site Scripting via the 'wrap' Shortcode Attribute. This issue affects all versions up to and including 3.1 due to insufficient input sanitization and output escaping.

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via post titles in the admin URI Editor interface. This affects all versions up to and including 2.5.3.3 due to insufficient output escaping.

The LearnPress WordPress plugin before version 4.3.7 does not gate the `edit` context on one of its REST endpoints, allowing unauthenticated users to retrieve user roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request.

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM, allowing for Stored Cross-Site Scripting attacks.

In OpenBSD before version 076e2b1, there is a vulnerability in the sppp_pap_input function that allows authentication bypass via certain zero values for lengths.

JetFormBuilder versions up to 3.6.1 contain a vulnerability allowing subscriber privilege escalation.

The WooCommerce Anti-Fraud plugin in versions up to 7.2.6 has a broken access control vulnerability that allows unauthorized access to functions.