Unknown

The issue allows attackers to create user accounts with arbitrary capabilities, effectively enabling them to create administrator accounts at will. This is being actively exploited. The plugin has over 200,000 active installations. Attackers are setting the `wp capabilities` user meta value to gain administrator privileges and full access to vulnerable sites. Despite attempts to fix the issue in versions 2.6.3, 2.6.4, 2.6.5, and 2.6.6, ways to exploit it still exist.

The issue is related to a Denial of Service (DoS) vulnerability due to missing nested depth limitation for collections in the SnakeYAML library, which is used for serialization and deserialization of YAML documents. This vulnerability can be exploited by a remote attacker to cause a service disruption.

The vulnerability is related to the deserialization of untrusted data by bypassing the default autoType shutdown restrictions in the Fastjson library. This can be exploited under certain conditions, allowing attackers to execute remote code. The issue is associated with the AutoTypeCheck mechanism in Fastjson, which can lead to security problems during deserialization if the JSON is controlled by the user and AutoType is enabled.

The issue concerns malicious code embedded in the node-ipc package, targeting users with IP addresses located in Russia or Belarus. This code overwrites files with a heart emoji. The package has around a million downloads per week and is used as a dependency by 354 packages, including vue-cli. All projects with node-ipc in their dependencies are also affected. The malicious code is activated with a 25% probability and affects systems with IP addresses from Russia or Belarus.

The issue is related to an Open Redirect vulnerability due to missing validation of the `return url` query parameter. This allows for potential redirection to unintended locations.

The issue is related to a Denial of Service (DoS) introduced through an infinite loop in the `americanFlag` module of the colors package. This appears to be a purposeful attempt by a maintainer to make the package unusable. The maintainer of Faker.js also deliberately removed functional code, making it unusable as well.

The issue concerns a Regular Expression Denial of Service (ReDoS) in the `Handsontable.helper.isNumeric` function. This affects the handsontable package, making it vulnerable to denial of service attacks due to inefficient regular expression handling.

لا يعالج البرنامج بشكل صحيح المدخلات التي يقدمها المستخدم والتي تحتوي على بايتات فارغة. وقد يتيح ذلك للمهاجمين الوصول إلى `http://host/%00` والتسبب في تعطل الخادم.

The issue is related to the incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to gain access to confidential data, disrupt its integrity, and cause a denial of service. The vulnerability is due to the use of Fault to parse untrusted XML data, making it susceptible to XML External Entity (XXE) Injection attacks.

The issue concerns Command Injection via the stop function.

A vulnerability in the JPEG image parsing module could allow an unauthenticated, remote attacker to cause arbitrary code execution on an affected device. The issue is due to a stack overflow read. An attacker could exploit this by sending a crafted PDF file to an affected device.