CVE Catalog

A memory corruption vulnerability has been identified in the WebKit component of Apple iOS. This issue affects iOS devices including the iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation). The vulnerability arises from improper state management, which can be exploited by processing maliciously crafted web content, leading to arbitrary code execution. Apple is aware of reports suggesting that this vulnerability may have been actively exploited.

A cross-site scripting vulnerability has been identified in Next.js, a React framework, affecting versions 10.0.0 prior to 11.1.0. The issue arises when the 'next.config.js' file includes an 'images.domains' array that allows user-provided SVGs. Instances deployed on Vercel or with a non-default 'images.loader' are not vulnerable.

A stored cross-site scripting vulnerability exists in the WordPress plugin Simply Gallery Blocks with Lightbox, in versions through 2.2.0. This vulnerability allows users with low privileges to execute arbitrary script code within the application context. The issue arises from inadequate validation of image parameters in the metadata, particularly in the Lightbox feature.

A stored cross-site scripting vulnerability has been identified in the WP Video Lightbox WordPress plugin, affecting versions prior to 1.9.3. The issue arises because the plugin does not properly escape the attributes of its shortcodes. This flaw allows users with a minimum role of contributor to execute cross-site scripting attacks.

A reflected cross-site scripting vulnerability has been identified in the ShareThis Dashboard for Google Analytics WordPress plugin, affecting versions prior to 2.5.2. The issue arises because the plugin fails to properly sanitize or escape the 'ga_action' parameter in the stats view before rendering it in an attribute. This vulnerability is triggered when the plugin is linked to a Google Analytics account, allowing an attacker to execute malicious scripts in the context of a logged-in administrator.

A deserialization vulnerability in the Core Telephony framework of Apple iOS, macOS, and watchOS allows a sandboxed process to bypass sandbox restrictions. This issue was addressed with improved validation and is fixed in multiple Apple software updates. At the time of the release, Apple was aware of reports suggesting that this vulnerability may have been actively exploited.

A buffer overflow vulnerability has been identified in Apple iOS and iPadOS, specifically in versions prior to 15.2. This vulnerability allows an application to execute arbitrary code with kernel privileges. The issue arises from improper memory handling, which creates an opportunity for exploitation.

A vulnerability exists in the WebKit component of multiple Apple products, including iOS, iPadOS, macOS Monterey, tvOS, and watchOS. This vulnerability is an integer overflow that was introduced through the processing of maliciously crafted web content. The issue has been addressed with improved input validation. However, the vulnerability could be exploited to execute arbitrary code on the affected device.

A vulnerability exists in the GPU drivers of Apple iOS, iPadOS, and macOS Big Sur. This out-of-bounds write issue could enable a malicious application to execute arbitrary code with kernel privileges. The vulnerability has been addressed with improved bounds checking. Notably, Apple is aware of reports suggesting that this vulnerability may have been actively exploited.

A type confusion vulnerability has been identified in the XNU component of Apple iOS, iPadOS, and macOS. This vulnerability may allow a malicious application to execute arbitrary code with kernel privileges. It affects multiple versions of iOS, iPadOS, and macOS, including iOS 12.5.5, iOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, and Security Update 2021-001 Mojave. Apple is aware of reports that an exploit for this issue exists in the wild.

A vulnerability exists in the CoreGraphics component of multiple Apple products, including iOS 14.8, iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2. This vulnerability arises from an integer overflow that was introduced with JBIG2 image processing. It allows for arbitrary code execution when a maliciously crafted PDF is processed. Apple has acknowledged reports of active exploitation of this vulnerability.

A cross-site scripting (XSS) vulnerability exists in ReCaptcha Solver version 5.7. When the extension receives a response from various captcha-solving services, including Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, and BestCaptchaSolver.com, the data is inserted into the DOM as HTML. This flaw allows these services to gain full control over the user's browser.

A vulnerability exists in Amazon AWS CloudFront's TLSv1.2_2019 security policy, which allows the use of ciphers TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384. These ciphers are considered weak by some security standards. While CloudFront offers a newer security policy, TLSv1.2_2020, that does not include these ciphers, it is not clear when or if this policy will be available to all users.

A vulnerability in Sitecore versions through 10.1, when the Update Center is enabled, allows remote authenticated users to upload arbitrary files. This could lead to remote code execution by accessing the uploaded .aspx file through the admin/Packages URL.

A vulnerability allowing open redirects has been identified in Next.js versions 10.0.5 prior to 10.2.0 and 11.0.0 prior to 11.0.1, when using 'pages/_error.js' without 'getInitialProps' or with 'next export'. This issue does not affect Vercel deployments or those with 'pages/404.js'. The vulnerability arises from improperly handled path parsing, which could be exploited to redirect users from a trusted domain to an attacker's domain, potentially leading to phishing attacks.

A denial-of-service vulnerability has been identified in the jszip package, affecting versions prior to 3.7.0. The issue arises when a zip file is created with filenames that correspond to Object prototype values, such as __proto__ or toString. This manipulation results in an object with a altered prototype, which can disrupt normal functionality. The vulnerability can be exploited by crafting a zip file that includes these prototype-related filenames, causing the jszip library to process the file in a way that modifies the object's prototype and potentially leads to application errors or crashes.

A request smuggling vulnerability has been identified in Varnish Cache and Varnish Enterprise servers with HTTP/2 enabled. This issue allows attackers to bypass VCL authorization by sending POST requests with large Content-Length headers. The vulnerability affects Varnish Cache versions 5.x and 6.x prior to 6.5.2, as well as Varnish Enterprise 6.0.x prior to 6.0.8r3. The request smuggling can be exploited by sending crafted HTTP/2 requests that are not properly processed, potentially leading to unauthorized access or cache poisoning.

A denial-of-service vulnerability has been identified in gRPC Swift versions through 1.1.1. The issue arises in the HTTP2ToRawGRPCServerCodec component, where remote attackers can cause stack consumption and uncontrolled recursion by sending numerous small messages within a single HTTP/2 frame.

A remote code execution vulnerability has been identified in the Windows Print Spooler service. This issue arises because the service improperly handles privileged file operations. An authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges. The vulnerability is also known as 'PrintNightmare'.

A reflected cross-site scripting vulnerability has been identified in the Auth0 Next.js SDK, specifically in versions prior to and including 1.4.1. The issue arises in the callback handler, where an XSS payload can be injected through the 'error' query parameter. This payload is then processed as an error message, allowing an attacker to execute arbitrary code. Users of the SDK are affected unless they have implemented custom error handling that excludes the error message from being returned in an HTML response.

A vulnerability in Shopware versions prior to 6.4.1.1 allows private files to be publicly accessible when stored with certain Cloud Storage providers, provided the hashed URL is known. This issue arises from incorrect visibility settings in the application's configuration. When using Amazon AWS for storage, public access to the bucket containing private files can exacerbate the problem.

A command injection vulnerability has been identified in elFinder versions through 2.1.58. This issue allows attackers to execute arbitrary commands on the server via the PHP connector, even with minimal configuration. The vulnerability arises in the archive command, where the name parameter, although sanitized, can still be manipulated to include command execution arguments. Exploitation is possible by uploading a file, creating a zip archive with a crafted name that includes command injection payloads, and then executing the archive command.

A stored cross-site scripting vulnerability has been identified in the WP Prayer WordPress plugin, affecting versions prior to 1.6.2. The vulnerability allows authenticated users to submit prayer requests containing malicious JavaScript, which is then executed when the requests are displayed on the site. This issue arises because the plugin's input fields for prayer and praise requests lack proper validation, enabling the injection of XSS payloads.

A denial-of-service vulnerability exists in Envoy version 1.14.0. When an empty METADATA map is sent in an HTTP/2 request, it triggers a reachable assertion, causing the application to crash. This issue is remotely exploitable.

A denial-of-service vulnerability has been identified in the ProtonMail Web Client, specifically in versions prior to 3.16.60. This vulnerability arises from a regular expression that can be exploited to cause exponential backtracking, leading to a significant performance degradation. The issue occurs in the Autocrypt public key extraction process, where the regular expression improperly handles certain input patterns, allowing for crafted strings to disrupt normal operation.

A vulnerability exists in multiple WordPress plugins by WP-Buy, specifically in the Captchinoo, Google reCAPTCHA for Admin Login Page plugin, prior to version 2.4. Low privileged users can exploit this vulnerability using the AJAX action 'cp_plugins_do_button_job_later_callback' to install any plugin, including specific versions, from the WordPress repository. Additionally, the same AJAX action can be used to activate installed plugins, potentially leading to the exploitation of vulnerable plugins and more critical issues such as remote code execution.

A vulnerability exists in the WPBakery Page Builder Clipboard WordPress plugin in versions prior to 4.5.8. An AJAX action registered by the plugin lacked proper capability checks, enabling low-privilege users, such as subscribers, to unauthorizedly update license options, including the license key and email.

A stored cross-site scripting vulnerability has been identified in the WPBakery Page Builder Clipboard WordPress plugin, affecting versions prior to 4.5.6. The vulnerability arises from an AJAX action that lacked proper capability checks and data sanitization. This oversight allows low-privilege users (subscribers and above) to inject XSS payloads that are executed on all backend pages.

An integer overflow vulnerability has been identified in the kernel of Amazon Web Services FreeRTOS, affecting versions prior to 10.4.3. The issue arises in queue.c during the queue creation process.

A prototype pollution vulnerability exists in the Swiper package, specifically in versions prior to 6.5.1. This vulnerability allows attackers to inject properties into the Object prototype, potentially leading to unauthorized modifications that could be exploited within the application. The issue arises from the 'extendDefaults' function, which recursively merges objects without proper validation, allowing manipulation of the prototype chain.

A universal cross-site scripting vulnerability has been identified in the WebKit component of Apple iOS, iPadOS, and watchOS. This issue arises from improper management of object lifetimes, allowing maliciously crafted web content to be processed in a way that could lead to cross-site scripting. The vulnerability has been reported to be actively exploited.

A logic vulnerability allowing remote code execution has been identified in the WebKit component of Apple iOS, iPadOS, and macOS. This issue arises from insufficient restrictions in the handling of web content, which could be exploited by a remote attacker. The vulnerability affects WebKitGTK, the version of WebKit used in GTK applications, including those on macOS and iOS. The flaw has been addressed in multiple Apple software updates, including macOS Big Sur 11.2, Security Update 2021-001 for Catalina, Security Update 2021-001 for Mojave, iOS 14.4, and iPadOS 14.4.

A logic vulnerability in the WebKit component of Apple iOS, iPadOS, and macOS was addressed with improved restrictions. This vulnerability allows remote code execution and could have been actively exploited. It affects WebKitGTK+ versions prior to 2.30.6, as well as several different components in WebKit, including the WebKit framework itself, which is used by Safari and other applications.

A race condition vulnerability has been identified in multiple Apple products, including iOS, iPadOS, macOS, watchOS, and tvOS. This vulnerability allows a malicious application to elevate privileges. The issue arises from a race condition that was not properly managed, creating an opportunity for privilege escalation.

A request smuggling vulnerability has been identified in Netty versions prior to 4.1.61.Final, specifically in the 'io.netty:netty-codec-http2' component. The issue arises because the content-length header is not properly validated when a single Http2HeaderFrame is used with the endStream flag set to true. This lack of validation can lead to request smuggling when the HTTP/2 request is proxied to a remote peer and converted to HTTP/1.1. The vulnerability is particularly concerning because it follows a related issue (CVE-2021-21295) that was not fully addressed. Exploitation of this vulnerability allows an attacker to smuggle requests by manipulating the content-length header, taking advantage of the improper handling of HTTP/2 streams during the conversion to HTTP/1.1.

A vulnerability exists in MinIO, an open-source object storage service compatible with Amazon S3, prior to version RELEASE.2021-03-17T02-33-02Z. The issue allows for man-in-the-middle (MITM) attacks by modifying request bodies that should have integrity protected by chunk signatures. In PUT requests using aws-chunked encoding, MinIO typically verifies signatures at the end of each chunk. However, this verification can be bypassed if the client sends a misleading chunk size that is significantly larger than the actual data. As a result, the server completes the request without checking the chunk signature, creating a potential security risk.

A stored cross-site scripting vulnerability has been identified in Wiki.js versions prior to 2.5.190. This issue arises from mustache expressions in code blocks being processed by Vue during content injection, despite being enclosed within `<pre>` elements. A malicious user can exploit this vulnerability by crafting a wiki page that executes harmful JavaScript when viewed by others.

A denial-of-service vulnerability has been identified in Varnish Modules versions prior to 0.17.1. When used with Varnish Cache version 6.5 or later, the 'header.append()' and 'header.copy()' functions can be exploited by remote attackers to trigger an assertion failure or NULL pointer dereference. This issue is not present in organizations that only use Varnish Cache, as the vulnerable 'header' vmod is only available with the separate varnish-modules package. The exploitation of this vulnerability can cause the Varnish Cache daemon to restart, leading to increased cache misses, reduced performance, and higher load on backend servers.

A vulnerability exists in MinIO, an open-source object storage service compatible with Amazon S3, prior to version RELEASE.2021-03-04T00-53-13Z. The issue allows users to bypass a readOnly policy by generating a temporary 'mc share upload' URL. This vulnerability affects all users of MinIO's multi-user feature.

A command injection vulnerability has been identified in the System Information Library for Node.js, specifically in versions prior to 5.3.1. This vulnerability allows attackers to inject malicious commands that could be executed in the application's environment. The issue arises from insufficient validation of service parameters in several library functions, including 'inetLatency', 'inetChecksite', 'services', and 'processLoad'.

A command injection vulnerability has been identified in Lodash versions prior to 4.17.21. The issue arises in the template function, where improper validation of key names allows for the execution of arbitrary code. This vulnerability is particularly concerning because it could lead to the disclosure of sensitive information, unauthorized data modification, or a denial-of-service condition.

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in Lodash versions prior to 4.17.21. This vulnerability arises in the `toNumber`, `trim`, and `trimEnd` functions, where specially crafted input can cause excessive backtracking in the regular expression engine. As a result, the vulnerability can be exploited to create a denial-of-service condition by consuming a significant amount of CPU resources, thereby slowing down or crashing the application.

A vulnerability exists in NextAuth.js versions prior to 3.3.0 when the Prisma database adapter is used with the Email provider. The issue arises because the Prisma adapter verifies the token but fails to validate the associated email address. This flaw allows a valid token from one user to be used to sign in as another user. The vulnerability is not present in implementations using the default database adapter or those that do not use a database.

A privilege escalation vulnerability has been identified in Cloudflare WARP for Windows, in versions prior to 1.2.2695.1. The issue arises from an unquoted service path, which allows a malicious user or process with non-administrative privileges to gain administrative rights by exploiting this flaw. The vulnerability has been addressed in version 1.2.2695.1 by adding quotes around the service's binary path.

A remote code execution vulnerability exists in the angular-expressions package, prior to version 1.1.2. This vulnerability allows an attacker to execute arbitrary code by passing user-controlled input to the expressions.compile() function. The issue can be exploited in both browser and server environments. In the browser, any script can be executed, while on the server, any JavaScript expression can be run, leading to remote code execution.

A prototype pollution vulnerability exists in the GSAP package, specifically in versions prior to 3.6.0. This vulnerability allows an attacker to inject properties into JavaScript object prototypes, potentially leading to various impacts such as denial of service or remote code execution. The issue arises from the library's handling of JSON input, which can be manipulated to overwrite prototype properties. Exploitation of this vulnerability is possible in web applications, web servers, and certain application server environments.

A remote code execution vulnerability exists in Ignition versions prior to 2.5.2, which is used in Laravel and other products. This vulnerability allows unauthenticated remote attackers to execute arbitrary code due to the insecure handling of file_get_contents() and file_put_contents(). It is exploitable on Laravel versions prior to 8.4.2 when the application is in debug mode.

A vulnerability in Web-Sesame version 2020.1.1.3375 allows an unauthenticated attacker to download the application's source code. This issue arises from a misconfiguration that left JavaScript source maps accessible in the production Webpack setup. These source maps can reveal the original sources used to create the bundled files, including sensitive information such as API keys and developers' comments.

A cross-site scripting (XSS) vulnerability has been identified in the Advanced Custom Fields (ACF) WordPress plugin, specifically in versions prior to 5.8.12. The issue arises from improper escaping of strings in Select2 dropdowns, which could be exploited to inject malicious scripts.

A directory traversal vulnerability has been identified in Apache Flink versions 1.11.0, 1.11.1, and 1.11.2. This vulnerability allows attackers to read any file on the local filesystem of the JobManager through the REST interface, accessing files that are accessible by the JobManager process.