John

Authenticated users with Subscriber-level access and above can perform unauthorized installation and activation of the ProfileGrid plugin. This occurs because the `pg install profilegrid()` function, handled via the `wp ajax pg install profilegrid` AJAX endpoint, lacks proper capability checks and nonce validation. A nonce is a unique token used to protect against cross-site request forgery by verifying that the request was intentionally sent by the user.

An issue exists in the fair scheduler (`sched/fair`) regarding the tracking of `zero vruntime`. When two runnable tasks repeatedly perform a yield operation, they can enter a state where they leapfrog each other. Because `zero vruntime` is only updated during ticks or full enqueue/dequeue operations, and not during ` enqueue entity()` or ` dequeue entity()` calls from `put prev task()` or `set next task()`, the tracking can fall behind. If these tasks reach an overflow point within a single tick's duration, it can lead to system instability. This risk is further increased when multiple cgroups (control groups, a Linux kernel feature that limits, accounts for, and isolates the resource usage of a collection of processes) are involved, as there is no guarantee that every cgroup will receive a tick in a timely manner.

A CSRF issue in "/api/crontab" allows a threat actor to create a crontab entry in the router administration panel. The cronjob will execute the entry on the threat actor's defined interval, leading to remote code execution and filesystem access. If the router's default credentials are not rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.

The issue is related to improper access control, resulting in sensitive information exposure. A threat actor can access the "/files.md5" file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. These file paths can be tested, potentially leading to the disclosure of hardcoded credentials, API keys, or other sensitive data.

The issue allows for tweb/ft.php?u= attacks, which can lead to XSS attacks.

The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges.

The issue is a stack-based buffer overflow that occurs when converting a file, allowing remote attackers to execute arbitrary code via a crafted .mp3 file. This can be exploited with user assistance.

The issue is a stack-based buffer overflow that occurs when converting a file, allowing remote attackers to execute arbitrary code via a crafted .wma file. This can be exploited when a user assists the attack, such as by opening a malicious file.

The issue makes it easier for attackers to estimate whether a Word document contains a token, due to limited variation in size, metadata, and timestamp.

The issue concerns Vembu StoreGrid, where there is XSS in several PHP files, including interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php.

The issue concerns the server web interface of Vembu StoreGrid, where the front page leaks the private IP address. This leak occurs due to incorrect processing of an index.php trailing slash, which discloses the private IP address in the `ipaddress` hidden form value of the HTML source code.

The issue in WaveMaker Studio arises from the mishandling of the `studioService.download` method, specifically with the `inUrl` parameter. This mishandling leads to the disclosure of local files and enables Server-Side Request Forgery (SSRF) attacks. SSRF occurs when an attacker can manipulate a server into making requests to internal or external resources, potentially leading to unauthorized access or information disclosure.

The issue is related to Cross-Site Scripting (XSS) via the `desc` (also known as Description) or `table actionsaclN` parameter. This is connected to the files `haproxy listeners.php` and `haproxy listeners edit.php`.

An issue in Asterisk allows disclosure of which requests hit a defined endpoint when endpoint-specific ACL rules block a SIP request. Normally, blocked requests respond with a 403 forbidden. However, if an endpoint is not identified, a 401 unauthorized response is sent instead. This does not allow ACL rules to be bypassed to gain access to the disclosed endpoints.

The issue allows local users to cause a denial of service, resulting in a system hang, by executing a long series of FMA3 instructions. This can be demonstrated using the Flops test suite.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various pages, including the `Title` parameter to "MapView.aspx", `NetObject` parameter to "NodeDetails.aspx" and "InterfaceDetails.aspx", and the `ChartName` parameter to "CustomChart.aspx".