New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

News Kit Elementor Addons: PHP Object Injection by Subscriber users

The WordPress plugin News Kit Elementor Addons up to and including version 1.5.0 contains a PHP Object Injection flaw (CWE-502). An attacker with a Subscriber account can submit crafted serialized data that the plugin processes unsafely, which can lead to code execution, data access or manipulation on the server, depending on other installed components. No official patch was available at the time of research, and the fixed version is unknown.

BlazeThemes · News Kit Elementor Addons

Research and translation in progress – available shortly.

BuddyPress Xprofile Custom Field Types: PHP Object Injection by Subscribers

The WordPress plugin BuddyPress Xprofile Custom Field Types up to and including version 1.3.1 contains a PHP object injection vulnerability (CWE-502). An attacker with a Subscriber account can manipulate serialized data so that the server processes it as PHP objects, which may allow code execution, data access or denial of service. Exploitation requires a logged-in low-privilege account, so sites with open registration are most exposed. No vendor fix was found at the time of writing.

BuddyDev · BuddyPress Xprofile Custom Field Types

Dynamic QR Code – generator: PHP Object Injection in WordPress plugin

The WordPress plugin Dynamic QR Code – generator by sosidee, versions up to and including 1.0.1, contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes, which may allow manipulation of server-side objects. Depending on the other installed plugins and themes, this can lead to code execution, data access or denial of service. The CNA Patchstack rates it CVSS 8.8, and no fixed version has been confirmed.

sosidee · Dynamic QR Code – generator

Extra Fees for WooCommerce: PHP Object Injection

The Extra Fees for WooCommerce WordPress plugin up to and including version 4.4.0 contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor role can submit crafted serialized data, which the plugin unserializes, allowing manipulation of application logic. Successful exploitation can lead to code execution or data compromise on the server, depending on the classes available in other installed plugins and themes.

Dotstore · Extra Fees for WooCommerce

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

RT-Labs P-Net: Resource exhaustion through unreleased RPC sessions

RT-Labs P-Net is a Profinet device stack used in embedded firmware of industrial devices such as PLCs, I/O modules, drives and sensors. Versions before 1.0.3 do not release RPC sessions allocated for requests naming an unknown interface or object UUID, and do not start a timeout for them. A remote, unauthenticated attacker can exhaust the available sessions with repeated requests, so the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted.

RT-Labs · P-Net

ASP.NET Core: Privilege escalation through incorrect default permissions

Incorrect default file permissions in ASP.NET Core allow a local, authorized user with low privileges to elevate their privileges. Microsoft's advisory limits the issue to Linux installations of the .NET runtime and targeting-pack tarballs and to source-built .NET tarballs, but the official CVE record and some third-party sources list Windows and macOS as well. The impact is high confidentiality, integrity and availability on the affected host. No confirmed exploitation in the wild is known.

Microsoft · ASP.NET Core

Research and translation in progress – available shortly.

OpenText Advanced Authentication Server: Improper trust of untrusted data in logon

OpenText Advanced Authentication Server, a multi-factor authentication platform, trusts extraneous untrusted data in a way that lets an attacker reach functionality that should be restricted by access controls. The CNA describes it as a logon bypass, but the NVD entry was still awaiting analysis and the weakness classification differs between sources. The vendor advisories list the affected ranges; the attack is network-reachable and needs no privileges or user interaction according to the CVSS v4 vector.

OpenText · Advanced Authentication Server

Research and translation in progress – available shortly.

RT-Labs P-Net: Denial of service via unreleased RPC sessions and AR

P-Net, a PROFINET IO stack for embedded industrial field devices, does not release the Application Relationship and RPC session when an RPC request with incorrect endianness is rejected. Repeated requests exhaust the available sessions, and the device stops answering new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker on the network can cause a denial of service, which can interrupt a production process.

RT-Labs · P-Net

RT-Labs P-Net: NULL pointer dereference in implicit read handling

P-Net before 1.0.3, a PROFINET device stack used in industrial I/O devices, dereferences a NULL AR pointer when it handles an implicit read request without a valid AR UUID for a user specific record index. This happens only if the application has registered a read callback. A remote unauthenticated attacker who can reach the device can send such a request and crash it, causing a denial of service. The CVSS 8.7 score is the CNA's; NVD analysis is still pending.

RT-Labs · P-Net

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

RT-Labs P-Net: NULL pointer dereference on implicit read of AR record

P-Net, RT-Labs' embedded Profinet IO device library, dereferences a NULL AR pointer when it handles an implicit read request without a valid target AR UUID for an AR-specific record index or for the expected identification data of a slot or subslot. A remote, unauthenticated attacker who can reach a vulnerable device on the network can send such a request and crash it, causing a denial of service. Only availability is affected, but industrial devices that embed the library may stop until they are restarted.

RT-Labs · P-Net

RT-Labs P-Net: Out-of-bounds write when parsing AR Vendor Block requests

RT-Labs P-Net, a PROFINET device stack used in embedded industrial devices, contains an out-of-bounds write when parsing AR Vendor Block requests. Only builds with the compile option PNET_OPTION_AR_VENDOR_BLOCKS enabled are affected, and this option is disabled by default. A crafted Connect request sent over the network, without authentication or user interaction, can crash the device (denial of service) and potentially allow arbitrary code execution.

RT-Labs · P-Net

RT-Labs P-Net: Denial of service via infinite loop in PDPortDataCheck read

P-Net, RT-Labs' PROFINET device stack, enters an infinite loop when it handles a read request for the PDPortDataCheck record with subslot 0 (whole module). The port loop never advances, so the device stops responding. A remote, unauthenticated attacker with network access to the device can cause a denial of service that can halt the affected industrial device.

RT-Labs · P-Net

Research and translation in progress – available shortly.

IBM Langflow OSS: Arbitrary command execution via code generation

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection flaw (CWE-94) that allows arbitrary command execution on the server. An attacker needs a valid user account on the Langflow instance, and the IBM bulletin describes the flaw as exploitable with low privileges. Successful exploitation would give the attacker the privileges of the Langflow process; the CVSS score is 8.8 (High).

IBM · Langflow OSS