Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.

The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.

Path Traversal in NPM w-zip prior to 1.0.12.

An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.