| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory.
To remediate this issue, users should upgrade to version 0.17.0 or later. |
| Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.
This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43. |
| Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe. |
| Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them. |
| Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
| Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions. |
| Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. |
| Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
| Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. |
| Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. |
| Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. |
| Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. |
| Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. |
| Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. |
| Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. |
| Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. |
| Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. |
| Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions. |
| Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions. |
| Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions. |
