Just published.

An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.

Auth & access

SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability.

Disclosure Library

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/<tenant>/Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.

Disclosure Library

A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

Injection

A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

Injection

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.

Other Web app

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.

Other Web app

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.

Auth & access

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

XSS Web app

The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain sign-in token via `wp_create_nonce('wpml_sso')` on the logout landing page, where the browser has already discarded its authentication cookies — so `wp_get_session_token()` returns an empty string and the token collapses to the shared anonymous nonce for the current 12-hour tick rather than a user-bound secret — and then storing it in the `wpml_sso_user_<token>_<sha256('wpml_sso'.$domain)>` transient mapped to the victim's `user_id` with no binding to the specific sign-out action or requesting client. Because an unauthenticated attacker can independently derive the identical token by triggering the logout confirmation flow on `wp-login.php?action=logout`, and because the `is_iframe_request()` gate conditions (the per-domain SSO `started` transient and domain-hash derived from the public constant `SSO_NONCE`) are fully computable within the 60-second `SSO_TIMEOUT` window, an unauthenticated attacker can submit the forged `wpml_sso_token_domain` parameter with a `wpml_user_signed_in` status to a secondary language-domain endpoint before the legitimate `wpml_user_signed_out` iframe fires, causing WordPress authentication cookies to be issued for the victim. This makes it possible for unauthenticated attackers to gain access to accounts of users — including administrators — who are actively in the process of logging out during the race window.

Auth & access Browser & mail

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered.

XSS Device

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.

Disclosure Web app

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the PDF Generator addon to be active and an administrator-configured PDF body template to be enabled for the targeted contact form.

Disclosure Web app

A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.

Code execution

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Auth & access

A vulnerability that could allow an attacker to gain unauthorized access.

Auth & access Device

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.

Other Device

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

Other Browser & mail

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

Injection

The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.

Memory safety

A vulnerability to perform a privilege escalation attack on the server as a non-admin user.

Crypto Device

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

Memory safety

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.

Other

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

Code execution Device

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

Auth & access Device

A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.

Disclosure Device

A vulnerability that could allow an attacker to compromise a system.

Other Device

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.

Other Device

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.

Other Web app

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.

Other Browser & mail

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.

Code execution Web app

The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unauthenticated attackers to extract sensitive company data including owner and member WordPress user IDs, company billing email addresses, credit balances and full credit histories with admin user IDs, per-member purchase limits and spend totals, and shared-cart records containing purchase-order numbers.

Disclosure Web app

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.5.3.-00 before 9.0.5-00.

Other

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.

Other

Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.

Other

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: before 9.0.4-01.

Memory safety

Insecure Temporary File Vulnerability in Hitachi Dynamic Link Manager for AIX (for markets outside Japan) and Hitachi Dynamic Link Manager EX for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: from 7.4.1-00 before 9.0.4-01; Hitachi Dynamic Link Manager EX for AIX: from 7.4.1-00 before 9.0.4-01.

Other

Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

Memory safety

Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

Memory safety

UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.

Other

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01.

Injection

Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.

Memory safety

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

Memory safety

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

Injection

Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01.

Code execution OS & kernel

Stack-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

Memory safety

Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.

Other OS & kernel

Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.

Other Server

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.

XSS Server

Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.

Auth & access