CVE Vulnerability Catalog

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. Affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.2. Missing nonce validation in a global function allows unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings, via a forged request if they trick a site administrator into clicking a link.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the new request hostname. This affects versions from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3.

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. Affects versions from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. Affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to and including 3.8.8. This is due to insufficient escaping and lack of preparation on the SQL query. Authenticated attackers with shop manager-level access or above can append additional SQL queries to extract sensitive information from the database.

An out-of-bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data, triggering an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime and results in a controlled stop of the PLC application.

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, causing a stack overflow when redirect following is enabled. Affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The Link Library plugin for WordPress is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects versions before 7.9.4.

The VIN-DS783E-E6 device from Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Koollab LMS has a business logic vulnerability that allows an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising assessment integrity.

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the plugin then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.