Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.
sniproxy versions through 0.7.0 have a NULL pointer dereference vulnerability in the resolv_cancel() function. This flaw allows remote unauthenticated attackers to crash the sniproxy daemon by sending overlong hostnames, specifically TLS SNI names or HTTP Host headers of 254 or 255 characters that match a wildcard backend, then closing the connection to terminate the proxy process.
Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 have a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. When a recipient opens the affected folder, the injected script executes, potentially leading to mailbox content theft or redirection.
Axigen Mail Server versions before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 have an unauthenticated denial of service vulnerability. This flaw is due to unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. An attacker can send a single deeply nested request to various web service listeners, causing stack exhaustion and repeated crashes of SMTP, IMAP, POP3, and web services.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve a malicious comment containing a crafted shortcode. Once approved, the injected script executes for any visitor interacting with the video player on the affected page.
A SQL injection vulnerability exists in the cak-filemanagement-system affecting the mysqli_query function in admin/save_student.php. The flaw allows remote attackers to manipulate multiple parameters leading to SQL injection. Exploit code has been publicly disclosed, but the project has not issued a response or fix yet. The vulnerability is rated high severity with a CVSS score of 7.3.
The Themify Builder plugin for WordPress versions up to and including 7.8.4 contains a stored cross-site scripting (XSS) vulnerability in the 'variations' repeater field of Custom Font posts. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when a user views the Custom Fonts admin listing page.
The Avada Website Builder theme for WordPress and WooCommerce is vulnerable to an arbitrary file upload flaw in versions up to and including 7.16.2. The vulnerability arises from insufficient file type validation in the convert_palette_images_to_truecolor() function, allowing unauthenticated attackers to upload potentially executable files. This can lead to remote code execution on affected systems.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'comment' shortcode attribute 'align' in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into comments. Exploitation requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled, which causes shortcode attributes in comments to be rendered unescaped, affecting all users who view the injected content.
The Advanced Custom Fields: Extended plugin for WordPress versions up to and including 0.9.2.7 contains a vulnerability that allows unauthenticated attackers to expose sensitive information. By injecting a {get_user} template tag into a publicly accessible form configured with specific shortcode and field mappings, attackers can retrieve sensitive data such as WordPress password hashes. This requires that an administrator has set up a public [acfe_form] shortcode page with a Term action using a save.name field mapping, which is a supported configuration.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.5.55.7212. This flaw arises from insufficient input sanitization and output escaping of the 'fv_player_videos[_fv_player_user_video][]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts into pages, which execute when accessed by other users. Exploitation requires that an administrator has enabled the 'Allow visitors to upload videos to their profile' setting.
A Cross-Site Request Forgery (CSRF) vulnerability exists in WPExperts APIExperts Square for WooCommerce (woosquare) versions up to 4.7.5. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation.
pybars3 versions up to 0.9.7 have a code injection vulnerability in the pybars/_compiler.py component. This flaw allows template authors to execute arbitrary Python code by supplying crafted Handlebars templates with unescaped bracketed path segments. The vulnerability enables breaking out of string literals and running Python code within the application process.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.7.1 due to improper neutralization of script-related HTML tags. This allows an attacker to inject code into web pages generated by the affected software. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Scribus versions prior to 1.6.7 have an out-of-bounds memory access vulnerability in the importsvm plugin. This flaw occurs because the plugin does not verify that bitmap and transparency mask dimensions match when importing SVM files. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution with the privileges of the user running Scribus.
Scribus versions prior to 1.6.7 have a heap buffer overflow vulnerability in the PICT image loader and import plugin. This flaw arises from improper validation of the bytesPerLine value in PICT files, which can exceed the QImage scanline size. Exploiting this vulnerability can cause Scribus to crash and potentially allow code execution with the privileges of the user running the application.
Scribus versions before 1.6.7 have a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin. This occurs when unpacking 4-bit indexed pixel data from a crafted PICT file with inconsistent width and row data. Exploitation can cause application crashes or potentially allow code execution.
Scribus versions prior to 1.6.7 contain an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin. This flaw occurs when decoding planar pixel data from crafted PICT files with manipulated dimensions, potentially causing heap over-reads. Exploitation can lead to application crashes or disclosure of heap memory contents.