Archive
28 April 2023
Vulnerabilities first published on this day (UTC), newest first.
48 results · Clear filters · Feed
-
Medium 6.3
SourceCodester AC Repair and Services System manage_user.php sql injection
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possi…
-
Medium 6.3
SourceCodester AC Repair and Services System view_inquiry.php sql injection
A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. The…
-
Medium 6.3
SourceCodester AC Repair and Services System view_booking.php sql injection
A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/bookings/view_booking.php. The manipulation of the argument id leads to sql injection. Th…
-
Medium 6.3
SourceCodester AC Repair and Services System view_service.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. This affects an unknown part of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. It is poss…
-
Medium 6.3
SourceCodester AC Repair and Services System view.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. Affected by this issue is some unknown functionality of the file services/view.php. The manipulation of the argument id leads to sql injecti…
-
Medium 4.3
Netgear SRX5308 Web Management Interface cross site scripting
A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument USERDBUsers.Password leads to cross site scripting. The a…
-
Medium 4.3
Netgear SRX5308 Web Management Interface cross site scripting
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interface. The manipulation of the argument Login.userAgent leads to cross site scripting. It is possible t…
-
Medium 4.9
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password …
-
Medium 5.3
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be…
-
Medium 5.3
Denosaurs emoji has ReDoS vulnerability in `replace` function
The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3…
-
Medium 6.4
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the …
-
Medium 5.9
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868.
-
Medium 5.1
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187.
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 5.9
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862.
-
Medium 5.4
IBM Maximo Asset Management HTML injection
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force …
-
Medium 6.5
Netgear SRX5308 denial of service
A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the…
-
Medium 4.6
Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard di…
-
Medium 5.5
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow lo…
-
Medium 6.3
SourceCodester Online DJ Management System GET Parameter view_details.php sql injection
A vulnerability classified as critical was found in SourceCodester Online DJ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/inquiries/view_details.php of the component GET Parameter Handler. The manipulatio…
-
Medium 6.3
SourceCodester Online DJ Management System GET Parameter manage_event.php sql injection
A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/events/manage_event.php of the component GET Parameter Handler. The manipulation of the argument id lead…
-
Medium 4.7
SourceCodester Faculty Evaluation System manage_restriction.php sql injection
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/manage_restriction.php. The manipulation of the argument id leads to sql injection. The atta…
-
Medium 4.7
SourceCodester Faculty Evaluation System sql injection
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php?page=manage_questionnaire. The manipulation of the argument id leads to sql injection. T…
-
Medium 4.7
SourceCodester Faculty Evaluation System manage_academic.php sql injection
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/manage_academic.php. The manipulation of the argument id leads to sql injection. It is possible to i…
-
Medium 6.3
SourceCodester Faculty Evaluation System sql injection
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajax.php?action=delete_class. The manipulation of the argument id leads to sql injection. Th…
-
Medium 6.3
SourceCodester Faculty Evaluation System sql injection
A vulnerability has been found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax.php?action=delete_subject. The manipulation of the argument id leads to sql …
-
Medium 4.3
SourceCodester Resort Reservation System registration.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possi…
-
Medium 6.3
SourceCodester Resort Reservation System view_room.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing of the file view_room.php. The manipulation of the argument id leads to sql injection. The attack may…
-
Medium 5.2
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
-
Medium 5.9
IBM Safter Payments information disclosure
IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt…
-
Medium 5.3
IBM Safer Payments denial of service
IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted…
-
Medium 6.5
IBM Safer Payments denial of service
IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of se…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbi…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback paramet…
-
Medium 5.4
Stored cross site scripting on tags
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
-
Medium 5.4
Stored cross site scripting via container name
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.
-
Medium 5.4
Stored cross site scripting on saved presets
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
-
Medium 5.3
Missing rate limit for password resets
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
-
Medium 5.5
Stored cross site scripting on API integration
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
-
Medium 6.1
Reflected cross site scripting
Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.