| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. |
| SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects Royal Event: from n/a through 2.0. |
| A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. |
| A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise. |
| Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
| Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
| Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. |
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. |
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. |
| Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. |
| Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions. |
| Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. |
| Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. |
