CVE Catalog

A vulnerability in TrueFiling, a cloud-based electronic filing system, prior to version 3.1.112.19, allowed users to manipulate client-controlled identifiers in URL requests. This manipulation could be used to gain partial access to case information and alter user access to that information. The issue arose because TrueFiling trusted certain identifiers passed by clients, enabling authenticated users to exploit this trust and access or modify case details. All instances of TrueFiling were updated to address this vulnerability by November 8, 2024.

A directory traversal vulnerability has been identified in the Eventer plugin for WordPress, affecting all versions through 3.9.7. The issue arises in the eventer_woo_download_tickets() function, where authenticated attackers with Subscriber-level access or higher can exploit the vulnerability to read arbitrary files on the server. This could lead to the exposure of sensitive information.

A reflected cross-site scripting vulnerability has been identified in the WP Inventory Manager plugin for WordPress, affecting all versions through 2.3.2. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link that contains the malicious payload.

A stored cross-site scripting vulnerability has been identified in the WordPress Payment Button for PayPal plugin, affecting all versions through 1.2.3.35. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'wp_paypal_checkout' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are executed when users access those pages.

A stored cross-site scripting vulnerability has been identified in the Checkout for PayPal plugin for WordPress, affecting all versions through 1.0.32. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in the plugin's 'checkout_for_paypal' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which are executed when users access the affected pages.

A vulnerability exists in IBM QRadar WinCollect Agent versions 10.0.0 through 10.1.12, allowing remote attackers to inject XML data into parameter values. This issue arises from inadequate input validation of data that is presumed to be immutable, potentially leading to unauthorized modifications.

A path traversal vulnerability has been identified in IBM InfoSphere Information Server version 11.7. This vulnerability could allow a remote attacker to traverse directories on the system by sending a specially crafted URL request that includes 'dot dot' sequences. This could enable the attacker to view arbitrary files on the system.

A vulnerability allowing elevation of privilege has been identified in Windows Secure Kernel mode. This issue affects several different versions and ranges of Windows 10, Windows 11, Windows Server 2025, and Windows Server 2025 (Server Core installation). The vulnerability arises from incorrect permission assignments for critical resources, enabling authenticated attackers to escalate privileges by overwriting page table data intended for the kernel. This vulnerability impacts ARM64 architecture only.

A stack-based buffer overflow vulnerability has been identified in Fuji Electric Alpha5 SMART servo drive systems, specifically in versions 4.5 and prior. This vulnerability could allow an attacker to execute arbitrary code on the affected system.

A cross-site scripting (XSS) vulnerability has been identified in LibreNMS versions through 24.10.1. The issue arises on the '/addhost' page, specifically within the community parameter, allowing remote attackers to inject malicious scripts. These scripts execute immediately when a user interacts with the page, potentially leading to unauthorized actions or data exposure. The vulnerability has been patched in version 24.11.0.

A stored cross-site scripting vulnerability has been identified in LibreNMS versions prior to 24.10.1. The issue resides in the 'ajax_form.php' file, specifically within the 'state' parameter. This vulnerability allows remote attackers to inject malicious scripts, which are executed immediately when a user interacts with the affected page. The injection occurs because untrusted data is retrieved and displayed without proper sanitization, potentially leading to unauthorized actions or exposure of sensitive information.

A stored cross-site scripting vulnerability has been identified in LibreNMS versions prior to 24.10.1. The issue resides in the 'Description' parameter of the '/ajax_form.php' endpoint, allowing remote attackers to inject malicious scripts. When the injected script is viewed or interacted with, it executes immediately, potentially leading to unauthorized actions or data exposure. This vulnerability has been patched in LibreNMS version 24.11.0.

A stored cross-site scripting vulnerability has been identified in LibreNMS versions prior to 24.11.0. The issue resides in the '/device/$DEVICE_ID/edit' endpoint, specifically within the 'display' parameter. This vulnerability allows remote attackers to inject malicious scripts that are executed when users view or interact with the affected page, potentially leading to unauthorized actions or data exposure.

A local file inclusion vulnerability has been identified in Zenitel AlphaWeb XE version 11.2.3.10. The issue arises in the amc_uploads.php component, allowing authenticated users to access sensitive files on the server.

A directory traversal vulnerability has been identified in Zenitel AlphaWeb XE version 11.2.3.10, specifically within the component '/php/script_uploads.php'. This issue allows authenticated attackers to access sensitive files on the server.

A stack-based buffer overflow vulnerability has been identified in the Tenda AC8v4 router, specifically in version 16.03.34.06. The issue arises in the function setSchedWifi within the file /goform/openSchedWifi. The vulnerability is triggered by manipulating the schedStartTime argument, leading to a stack overflow condition.

A stack overflow vulnerability has been identified in the Tenda AC8v4 router, specifically in version V16.03.34.06. The issue arises in the 'setSchedWifi' function within the '/goform/openSchedWifi' file. The vulnerability allows for a stack-based buffer overflow by manipulating the 'schedStartTime' parameter in a POST request. The function does not properly validate the input, enabling the user to exceed the buffer capacity and overwrite adjacent memory.

A stored cross-site scripting vulnerability has been identified in LibreNMS versions prior to 24.11.0. This issue allows remote attackers to inject malicious scripts into the 'Display Name' field of device settings. The injected script is executed when the data is viewed, potentially leading to unauthorized actions or exposure of sensitive information.

An authentication bypass vulnerability has been identified in OPEXUS FOIAXPRESS Public Access Link version 11.1.0. This issue allows attackers to bypass authentication mechanisms by sending crafted web requests.

A vulnerability in Themesbrand ChatVia version 5.3.2 allows remote attackers to escalate privileges by exploiting insecure permissions in the user profile name and image upload functions.

A vulnerability in Themesbrand Chatvia version 5.3.2 allows remote attackers to execute arbitrary code by exploiting the image upload feature in user profiles. The issue arises from improper handling of uploaded files, which can be manipulated to execute malicious code.

A null pointer dereference vulnerability has been identified in Macrium Reflect versions prior to 8.1.8017. This vulnerability allows a local attacker to cause a system crash or potentially elevate privileges by executing a specially crafted executable.

A JNDI injection vulnerability has been identified in Cloudera JDBC Connector for Hive versions prior to 2.6.26 and in JDBC Connector for Impala versions prior to 2.6.35. This vulnerability allows attackers to inject malicious parameters into the JDBC URL, which the JDBC Driver may then use to connect to the database. The injection can be exploited through the JDBC connection property 'krbJAASFile', related to the Java Authentication and Authorization Service (JAAS). Improper use of untrusted parameters in 'krbJAASFile' and/or remote host can trigger JNDI injection, potentially leading to remote code execution.

A vulnerability in Eugeny Tabby version 1.0.213 allows remote attackers to intercept sensitive information, specifically SSH usernames and passwords. This occurs even when host key verification fails, creating a potential for man-in-the-middle attacks. The issue has been present for a significant period.

An authentication bypass vulnerability has been identified in the Tenda AC1200 Smart Dual-Band WiFi Router, specifically in Model AC6 v2.0 running Firmware v15.03.06.50. This vulnerability arises from incorrect access control, allowing attackers to bypass authentication by sending a crafted web request. Once authenticated, attackers could potentially change router configurations or exploit other vulnerabilities.

A stored cross-site scripting vulnerability has been identified in the Kopatheme Kopa Nictitate Toolkit WordPress plugin, affecting versions through 1.0.2. This vulnerability arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A broken access control vulnerability has been identified in the WordPress Mark Posts plugin, affecting versions through 2.2.4. This vulnerability arises from missing authorization checks, which could allow an unprivileged user to perform actions reserved for higher privileges.

A missing authorization vulnerability has been identified in the Goldstar WordPress plugin, specifically in versions through 2.1.1. This vulnerability arises from incorrectly configured access control security levels, allowing unprivileged users to perform actions reserved for higher privileges.

A broken access control vulnerability has been identified in the WP Tasker WordPress Graphs & Charts plugin, affecting versions through 2.0.8. This vulnerability arises from missing authorization checks, which can be exploited by users with lower privileges to perform actions reserved for higher privileged users.

A missing authorization vulnerability has been identified in the Sur.ly WordPress plugin, specifically in versions through 3.0.3. This vulnerability arises from incorrectly configured access control security levels, allowing unprivileged users to perform actions reserved for higher privileges.

A missing authorization vulnerability has been identified in the Xola Bookings for Tours and Activities WordPress plugin, specifically in versions through 1.6. This vulnerability allows unprivileged users to exploit incorrectly configured access control, potentially leading to unauthorized actions that require higher privileges.

A broken access control vulnerability has been identified in the Salvador – AI Image Generator plugin by AWcode and KingfisherFox, affecting versions through 1.0.11. This vulnerability arises from missing authorization checks, allowing unprivileged users to exploit incorrectly configured access control security levels.

A stored cross-site scripting vulnerability has been identified in the WordPress Gallery: Hybrid – Advanced Visual Gallery plugin, affecting versions through 1.4.0.2. This vulnerability arises from improper input neutralization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress EZPlayer plugin, affecting versions through 1.0.10. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress WP-Player plugin, affecting versions through 2.6.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Enhanced YouTube Shortcode plugin, affecting versions through 2.0.1. This vulnerability arises from improper input neutralization during web page generation, allowing malicious actors to inject harmful scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress PDF.js Shortcode plugin, specifically in versions through 1.0. This issue arises from improper input sanitization during web page generation, allowing malicious scripts to be injected and executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the MeinTurnierplan.de Widget Viewer plugin for WordPress, affecting versions through 1.1. This vulnerability allows users to inject malicious scripts that are executed when other users view the affected page.

A stored cross-site scripting vulnerability has been identified in the WordPress Image Switcher plugin, affecting versions through 0.1.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the Saiem Khan Image Switcher WordPress plugin, affecting versions through 1.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress CC Circle Progress Bar plugin, affecting versions through 1.0.0. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the Magic Google Maps WordPress plugin, specifically in versions through 1.0.4. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress plugin 'Giveaways and Contests by PromoSimple', affecting versions through 1.24. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WpFreeware WpF Ultimate Carousel plugin for WordPress, affecting versions through 1.0.11. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.

A broken access control vulnerability has been identified in the iTechArt Group PayPal Marketing Solutions plugin, affecting versions through 1.2. This vulnerability arises from incorrectly configured access control security levels, allowing unprivileged users to perform actions reserved for higher privileges.

A missing authorization vulnerability has been identified in the WordPress Email Capture & Lead Generation Plugin, affecting versions through 1.0.2. This vulnerability arises from improperly configured access control, allowing unprivileged users to perform actions reserved for higher privileges.

A stored cross-site scripting vulnerability has been identified in the Google Org Chart WordPress plugin, affecting versions through 1.0.1. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress plugin Incredible Font Awesome, affecting versions through 1.0. This issue allows attackers to inject malicious scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the TC Ajax WP Query Search Filter plugin for WordPress, affecting versions through 1.0.7. This vulnerability arises from improper input sanitization during web page generation, allowing malicious actors to inject scripts that are executed when users visit the affected site.

A stored cross-site scripting vulnerability has been identified in the WordPress Feedburner Optin Form plugin, affecting versions through 0.2.8. This vulnerability allows attackers to inject malicious scripts that are executed when users visit the affected site.