Threats affecting pkg:bitnami/brotli

A PHP Object Injection vulnerability exists in Finale Lite versions up to and including 2.21.0. This flaw allows an attacker with high privileges to remotely execute code or cause a denial of service without user interaction.

A PHP Object Injection vulnerability exists in the Product Catalog Feed component of PixelYourSite versions up to and including 3.1.4. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service via crafted input. The flaw is identified as CWE-502 and has a CVSS 3.1 base score of 7.2, indicating a high severity impact.

A PHP Object Injection vulnerability exists in Sastra Essential Addons for Elementor versions up to and including 1.2.3. This vulnerability allows an attacker with author-level privileges to inject malicious PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in WP Media folders versions up to 1.1.10. This flaw allows a user with Contributor privileges to perform object injection attacks, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in News Kit Elementor Addons versions up to and including 1.5.0. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in Social Snap versions up to and including 1.5.4. This vulnerability allows an attacker with low privileges to execute arbitrary code or cause a denial of service without user interaction.

A PHP Object Injection vulnerability exists in myPOS Checkout versions up to and including 1.4.5. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service. The flaw is identified as CWE-502 and has a CVSS 3.1 score of 7.2, indicating high severity.

A PHP Object Injection vulnerability exists in BuddyPress Xprofile Custom Field Types versions up to and including 1.3.1. This vulnerability allows an attacker with subscriber-level privileges to perform PHP Object Injection, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in Frisbii Pay versions up to and including 1.8.19. This vulnerability allows an attacker with low privileges to execute arbitrary code or cause denial of service due to unsafe deserialization of user input.

P-Net versions before 1.0.3 contain a vulnerability where RPC sessions allocated for requests naming unknown interfaces or object UUIDs are not released and no timeout is started. An unauthenticated remote attacker can exploit this by sending repeated requests with different activity UUIDs to exhaust available sessions, causing the device to stop responding to new RPC requests until it is restarted, resulting in a denial of service.

A stored cross-site scripting (XSS) vulnerability exists in The Plus Addons for Elementor Page Builder Lite up to version 6.5.3. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

P-Net versions before 1.0.3 contain a vulnerability where the application alarm callback receives a data length derived from a variable part length field without verifying it against the actual frame length. This can cause the callback to process an excessively large length value, leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected.

A PHP Object Injection vulnerability exists in the Extra Fees Plugin for WooCommerce versions up to and including 4.4.0. This flaw allows an attacker with contributor-level privileges to inject malicious PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in Zippy versions up to and including 1.7.0. This vulnerability allows an attacker with high privileges to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

P-Net versions prior to 1.0.3 contain a vulnerability where the software does not verify the presence of a complete block header before reading the next block in DCP Set and Identify requests. This can lead to reading beyond the receive buffer boundary or processing a block with an underflowed length, potentially causing a crash or limited memory disclosure. Exploitation requires adjacent network access.

A PHP Object Injection vulnerability exists in WPCargo Track & Trace versions up to and including 8.0.5. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service due to unsafe deserialization of user input.

A PHP Object Injection vulnerability exists in Dynamic QR Code – generator versions up to and including 1.0.1. This flaw allows an attacker with limited privileges to execute arbitrary code or cause denial of service by injecting crafted PHP objects.

Adobe Digital Editions contains a path traversal vulnerability that allows an attacker to bypass security restrictions and gain unauthorized write access. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability changes the security scope but does not impact confidentiality or availability.

P-Net versions before 1.0.3 contain a vulnerability where the Application Relationship (AR) and RPC session are not released when an RPC request is rejected due to incorrect data representation endianness. This causes sessions to remain allocated, leading to exhaustion of available sessions. Once exhausted, the device stops responding to new RPC requests until restarted. This can be exploited remotely by an unauthenticated attacker to cause a denial of service.

P-Net versions before 1.0.3 contain a vulnerability in the get_check_peer() function where the LengthPeerStationName field of a CheckPeers block is not properly validated. This allows a crafted block to write up to 15 bytes beyond the 241-byte buffer allocated for the peer station name, potentially causing a crash or arbitrary code execution. Exploitation requires establishing a session with adjacent network access.