Threats affecting pkg:generic/p11-kit

The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication by spoofing client IP address headers. An attacker who has obtained a user's password can exploit the lack of validation of Client-IP and X-Forwarded-For headers to spoof a whitelisted IP address, thereby bypassing the second factor. This issue has been fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube has a vulnerability where sessions persist after failed two-factor authentication (2FA) attempts due to insufficient session expiration. An attacker who obtains a user's password may exploit this to keep the session alive and attempt to brute force the second-factor code. This issue was fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube suffers from a vulnerability that allows brute-forcing of the second-factor authentication code due to lack of rate limiting. An attacker who has obtained a user's password can repeatedly submit arbitrary 6-digit codes to bypass the second-factor authentication and gain unauthorized access. This issue has been fixed in a specific commit.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the category management functionality of the Phoca Download extension for Joomla versions 3.1.0 through 6.1.5. This vulnerability allows an attacker to trick an authenticated user into performing unwanted actions without their consent.

An authenticated IPMI Administrator can exploit this vulnerability to read arbitrary files from the BMC filesystem, exposing sensitive data beyond the intended IPMI management scope. The vulnerability has a CVSS score of 4.9, indicating medium severity. No patch or remediation details are currently provided.

An authenticated IPMI Administrator can read and write arbitrary physical memory on the Baseboard Management Controller (BMC), potentially allowing execution of code on the BMC operating system. This vulnerability has a high severity with a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability impacts. No specific affected versions or patches are provided in the available data.

An IPMI authenticated administrator may be able to execute commands as the operating system root user on the Baseboard Management Controller (BMC). This vulnerability has a CVSS score of 6.6, indicating a medium severity level. It involves command execution with high impact on confidentiality, integrity, and availability. No affected versions or patch information are provided.

A vulnerability in the BMC RAKP+ implementation allows an attacker to send a request followed by a specially crafted RAKP message to establish an RMCP+ session. This session could then be used to execute commands on the affected system. The flaw has a CVSS score of 7.4, indicating high severity.

The Qode Membership plugin for WordPress versions up to and including 2.0.6.2 contains an authentication bypass vulnerability due to a typographic error in Facebook OAuth token verification. This flaw allows unauthenticated attackers to bypass token validation and log in as any existing WordPress user, including administrators, by exploiting a publicly accessible nonce. The vulnerability arises from an undefined variable causing the token verification check to be skipped, enabling account takeover.

A logic flaw in the Baseboard Management Controller (BMC) IPMI implementation allows an attacker with limited privileges to send specially crafted RAKP+ messages and escalate their account to administrator privileges. This vulnerability can lead to full control over the BMC, impacting confidentiality, integrity, and availability.

An OS command injection vulnerability exists in the OnCell G3150A-LTE Series devices. This vulnerability occurs when the SMS management functionality is enabled and configured, allowing a remote attacker with required privileges to execute arbitrary commands due to insufficient input validation.

A vulnerability in the Baseboard Management Controller (BMC) allows improper enforcement of integrity and encryption requirements for IPMI commands. This flaw enables an attacker to craft malicious packets that could execute arbitrary commands within an active session. The vulnerability has a critical severity rating with a CVSS score of 9.8.

CVE-2026-18451 describes a vulnerability in the HTML5 KVM-over-IP console authentication mechanism where session tokens returned by the web interface can be guessed due to weaknesses in token generation. This could allow an attacker to take control of an active KVM session. The vulnerability has a low CVSS score of 3.1, indicating limited impact and exploitability.

CVE-2026-16521 is an OS command injection vulnerability caused by insufficient input filtering in a BMC function. An attacker with high privileges can inject malicious commands that may execute when the related service is restarted. This vulnerability has a high severity score of 7.2 and impacts confidentiality, integrity, and availability.

The Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption requirements for IPMI commands. This vulnerability allows an attacker to craft malicious packets that could execute arbitrary commands on an active session without requiring privileges or user interaction. The issue poses a high security risk due to the potential for unauthorized command execution.

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This affects all versions up to and including 4.61.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

This vulnerability involves a hardcoded key in the GSS Deployment Server installation that, if obtained by an attacker, could allow decryption of sensitive credentials including domain/service account passwords, task run-as credentials, and sysprep passwords. The flaw has a high severity rating with a CVSS score of 7.6. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.

An improper certificate validation vulnerability in Moxa Remote Connect Suite (MRC Client) allows an unauthenticated attacker with on-path access to impersonate a trusted server. This can enable a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications between the client and server.

CVE-2026-107472 is an out-of-bounds read vulnerability in the QTextCodec TSCII encoding implementation within the Qt 5 Compatibility APIs module. This flaw affects Qt Core in Qt 5 and earlier versions. Applications that convert text to the TSCII encoding using QTextCodec may read memory beyond the input buffer, potentially causing crashes or incorrect data interpretation.

The Kirki WordPress plugin up to version 6.2.5 contains a privilege escalation vulnerability via PHP Object Injection. This occurs due to deserialization of untrusted input in an AJAX dispatcher without proper capability checks, allowing authenticated users with Subscriber-level access or higher to inject PHP objects. Exploitation can lead to overwriting an administrator's password and gaining full administrative control.