CVE Vulnerability Catalog

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affects Spring Tools for Eclipse 5.2.0 and earlier.

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affects Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier.

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the initiating operator, allowing a lower-privileged account that an operator is switched into to be resolved as that operator and switch into any permitted account, including an administrator, resulting in full account takeover.

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label from a request parameter, and does not escape that label when echoing it on the filter admin page. An unauthenticated attacker can trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored XSS via CSRF).

The Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration. Unauthenticated users can register directly into a privileged group and be granted that group's configured role, up to Administrator, leading to privilege escalation.

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).

A stack-based buffer overflow vulnerability was found in the File Explorer on ADM. User-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer, potentially causing denial of service of the CGI process.

A path traversal vulnerability was found in the VPN Clients on ADM. User-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path.

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to 14.5.0. The bp_unserialize_profile_field() function uses @unserialize() without the allowed_classes parameter on user-controlled XProfile field data.

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in versions up to 2.6.2.2. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the users_can_register setting.

A format string vulnerability was found in the Notification OAuth settings of ADM. User-controlled notification configuration input may be processed through an unsafe format string operation.

Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this to gain file system read access.

A format string vulnerability was found in the Rsync Backup on ADM. User-controlled rsync backup configuration or log data may be processed through an unsafe format string operation.

A format string vulnerability in the Internal Backup function of ADM. User-controlled task input is processed unsafely, allowing memory information disclosure or denial of service.