Vulnerabilities

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.<br /> <br /> This issue affects Apache Struts: 7.2.1.<br /> <br /> Users are recommended to upgrade to version 7.3.0, which fixes the issue.

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.<br /> <br /> This issue affects Apache Struts: 7.2.1.<br /> <br /> Users are recommended to upgrade to version 7.3.0, which fixes the issue.

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected.<br /> <br /> This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.<br /> <br /> Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework&amp;#39;s internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.<br /> <br /> This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.<br /> <br /> Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure.

The Templately – Elementor &amp; Gutenberg Template Library: 6500+ Free &amp; Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately&amp;#39;s entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can(&amp;#39;delete_posts&amp;#39;) check, with no administrator or manage_options capability requirement. The same permission gate also allows a contributor to overwrite the site&amp;#39;s global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true. A complete remediation should both correct fetch_remote_file to validate the file type against the actual destination filename rather than the Content-Disposition header (and avoid deriving the write path from the request URL), and restrict state-changing Templately REST routes to an appropriate administrator-level capability.

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the &amp;#39;Assigning requested role directly&amp;#39; option.

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site&amp;#39;s Administrator account (user ID 1), resulting in full administrative takeover of the site.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry<br /> <br /> device_pasid_table_teardown() zeroes the 128-bit scalable-mode context<br /> entry with context_clear_entry() while the Present bit is still set. This<br /> creates a window where the hardware can fetch a torn entry, with some<br /> fields already zeroed while Present is still set, leading to unpredictable<br /> behavior or spurious faults. The context-cache invalidation is issued only<br /> after the entry has been zeroed, and intel_pasid_free_table() then frees<br /> the PASID directory pages, so the IOMMU can keep walking a stale Present=1<br /> entry that points at freed memory.<br /> <br /> While x86 provides strong write ordering, the compiler may reorder the two<br /> 64-bit writes to the entry, and the hardware fetch is not guaranteed to be<br /> atomic with respect to multiple CPU writes.<br /> <br /> Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down<br /> context entry") fixed this exact pattern in domain_context_clear_one() and<br /> the copied-context path, but device_pasid_table_teardown() was not<br /> converted.<br /> <br /> Align it with the "Guidance to Software for Invalidations" in the VT-d<br /> spec, Section 6.5.3.3, using the same ownership handshake as the sibling<br /> fix: clear only the Present bit, flush it to the IOMMU, perform the<br /> context-cache invalidation, and only then zero the rest of the entry.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rxrpc: Fix the reception of a reply packet before data transmission<br /> <br /> Fix rxrpc_receiving_reply() to handle the reception of an apparent reply<br /> DATA packet before rxrpc has had a chance to send any request DATA packets<br /> on a client call by checking to see if the call has been exposed yet by<br /> sending the first packet.<br /> <br /> Without this, rxrpc_rotate_tx_window() might oops.<br /> <br /> Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by<br /> changing the do...while loop into a while loop, just in case a call is<br /> abnormally terminated by an early reply before the last request packet is<br /> transmitted.