Vulnerabilities

Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS.<br /> <br /> This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company&amp;#39;s product and to hijack that product by reassigning its company_id, via the product&amp;#39;s numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data[&amp;#39;id&amp;#39;])` without constraining the query to the authenticated user&amp;#39;s company before overwriting its company_id.

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

Re-pairing with a legitimate device can use a lower security level than<br /> previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

SMP security request (from peripheral) does not include the maximum<br /> encryption key size supported. Using a key with less than the maximum keysize<br /> makes brute-forcing the key easier. See V6 in BLERP paper linked below.

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes<br /> valid QUIC Initial packets for unknown destination connection IDs, it<br /> can allocate and queue new incoming channels without enforcing any limit.<br /> <br /> Impact summary: A remote peer that can make many Initial packets reach the<br /> server listener faster than the application accepts connections, can cause the<br /> memory allocated to store the per-channel state to grow without any limits,<br /> potentially making the QUIC listener unavailable and causing Denial of Service.<br /> <br /> CWE: CWE-770: Allocation of Resources Without Limits or Throttling<br /> <br /> Description: The function that handles inbound QUIC packets uses<br /> Connection-Id from the packet header to find an existing connection<br /> (QUIC channel). If no existing connection is found and the packet<br /> type is INITIAL, the function treats the packet as a new connection. It<br /> allocates a new channel object and inserts it into a queue where it<br /> waits to be accepted by the local application with SSL_accept(3ossl).<br /> The memory occupied by these initial channel objects may grow<br /> without bounds if the application is not able to call SSL_accept()<br /> frequently enough to serve these inbound connection requests.<br /> <br /> The issue is present since OpenSSL 3.5 when the QUIC server implementation<br /> was added.<br /> <br /> The fix introduces a limit for pending connections. The default limit is set<br /> to 256 pending connections (waiting to be accepted by the local application).<br /> Applications may change the default by calling SSL_set_value_uint(3ossl).<br /> <br /> FIPS impact: no<br /> The FIPS module is not affected as the QUIC implementation is outside of<br /> the OpenSSL FIPS module boundary.

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

Unauthenticated Broken Access Control in GiveWP

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce