CVE Vulnerability Catalog

The Plugin Organizer plugin for WordPress up to version 10.2.4 is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in the perform_plugin_search() function. Insufficient escaping and validation, along with missing nonce and capability checks in the AJAX handler, allow authenticated attackers (subscriber-level and above) to append additional SQL queries and extract sensitive information from the database.

In nebula-mesh prior to version 0.3.7, decrypted CA private keys remain in the process heap after use because they are not zeroed before memory release. This violates the keystore package contract and could lead to key leakage. This issue has been fixed in version 0.3.7.

The BlackBerry UEM Management Console in version 12.23.0 QF8 and earlier has improper input validation, allowing arbitrary file download and potential denial of service (DoS).

An XSS vulnerability in the BlackBerry UEM Management Console. Improper input neutralization allows an attacker to inject malicious scripts.

IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow a user to supply a password with a resource dump request, which is then stored in the BMC audit log where an admin user can see it.

IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow ReadOnly users to escalate privileges and give themselves administrator privileges.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to stored cross-site scripting. A privileged user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling vulnerability. The proxy implementation in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks.

Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL.

tiny-http through version 0.12.0 contains an HTTP request smuggling vulnerability. Sending a Transfer-Encoding header with any value causes unconditional chunk-decoding and discarding of Content-Length, enabling desynchronization attacks.

Let's Chat versions 0.3.0 through 0.4.8 contain an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification.

Let's Chat versions 0.3.0 through 0.4.8 contain a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route.

Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database.

Rouille versions 0.4.0 through 3.6.2 contain an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input.

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.

Mattermost fails to verify file deletion path, allowing an admin with SAML system-console write permissions to delete arbitrary files outside the config directory via the remove file endpoint.

In Apache Tomcat, the WebSocket chat example has an uncontrolled resource consumption vulnerability. Affected versions: 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120.

Pivotick did not validate the URI scheme of node imagePath values, allowing an attacker to set a malicious URI. When a victim renders the graph, the browser could initiate an unintended request or invoke scheme-specific handling.

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled node identifiers. Identifiers matching inherited properties from Object.prototype (e.g., constructor, __proto__) could be misinterpreted, leading to omitted nodes, incorrect hierarchies, bypassed cycle detection, or exceptions causing denial of service.

Pivotick's Markdown node-reference renderer fails to HTML-escape the attacker-controlled nodeName value, allowing injection of malicious HTML attributes or elements. This can lead to arbitrary JavaScript execution in the victim's browser.