Heap-based buffer overflow in HDF5 up to 1.14.6 allows local attackers to execute arbitrary code or cause denial of service via a crafted file. Public exploit code exists, but no active exploitation in the wild has been confirmed. EPSS score is low (0.05%), indicating low exploitation probability.
Reachable assertion in WebAssembly wabt up to 1.0.37 via the LogOpcode function in src/binary-reader-objdump.cc allows local attackers to cause a denial of service. A public exploit exists, but the vendor doubts real-world impact and a patch is available. EPSS score is low (0.04%), indicating minimal exploitation risk.
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in Hydra (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directory potentially leading to the disclosure of sensitive information. Note: Admin level privilege is required on the switch in order to exploit
Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site scripting (XSS) vulnerability in Luna Imaging up to version 7.5.5.6 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in the /luna/servlet/view/search endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Path traversal vulnerability in OpenBMB XAgent up to version 1.0.0 allows attackers to read arbitrary files via the /conv/community endpoint. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating limited exploitation likelihood.
Open redirect vulnerability in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to redirect users to arbitrary external sites via the 'q' parameter in /search-report-result.php. The exploit has been publicly disclosed, increasing risk of phishing attacks. EPSS score is low (0.04%), indicating low exploitation likelihood in the wild.