Archive
2 November 2023
Vulnerabilities first published on this day (UTC), newest first.
38 results · Clear filters · Feed
-
Medium 5.9
IBM CICS TX privilege escalation
IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163.
-
Medium 4.8
IBM CICS TX cross-site scripting
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot…
-
Medium 4.3
IBM CICS TX cross-site request forgery
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website tru…
-
Medium 5.5
Campcodes Simple Student Information System manage_academic.php sql injection
A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/students/manage_academic.php. The manipulation of the argument id leads to sql injection. The exp…
-
Medium 5.5
Campcodes Simple Student Information System manage_department.php sql injection
A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/departments/manage_department.php. The manipulation of the argument id leads to sq…
-
Medium 5.5
Campcodes Simple Student Information System manage_course.php sql injection
A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/courses/manage_course.php. The manipulation of the argument id leads to…
-
Medium 5.5
Campcodes Simple Student Information System update_status.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown function of the file /admin/students/update_status.php. The manipulation of the argument student_id leads to sql injection.…
-
Medium 5.5
Campcodes Simple Student Information System Master.php sql injection
A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument f leads to sql injection. The ex…
-
Medium 6.0
CVE
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to denial of service.
-
Medium 5.5
CVE
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.
-
Medium 5.5
CVE
NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of service.
-
Medium 5.5
CVE
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.
-
Medium 6.1
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.
-
Medium 6.5
CVE
NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.
-
Medium 5.5
Campcodes Simple Student Information System view_course.php sql injection
A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown code of the file /admin/courses/view_course.php. The manipulation of the argument id leads to sql injection. The exploit ha…
-
Medium 5.5
Campcodes Simple Student Information System index.php sql injection
A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to …
-
Medium 6.2
Potential buffer overflow in php_cli_server_startup_workers
A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
-
Medium 6.2
Reachable assertion in avahi_alternative_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
-
Medium 6.2
Reachable assertion in avahi_rdata_parse
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
-
Medium 6.2
Reachable assertion in dbus_set_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
-
Medium 6.2
Reachable assertion in avahi_escape_label
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
-
Medium 6.2
Reachable assertion in avahi_dns_packet_append_record
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
-
Medium 4.7
SourceCodester Company Website CMS Create Blog Page createblog unrestricted upload
A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /dashboard/createblog of the component Create Blog Page. The manipulation leads to unrestricted…
-
Medium 5.3
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowi…
-
Medium 4.3
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, in…
-
Medium 5.4
Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.…
-
Medium 5.4
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be inj…
-
Medium 6.1
Presentations may contain references to images, which are user-controlled, and could include malicious script code that…
-
Medium 5.4
Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before…
-
Medium 5.6
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent…
-
Medium 5.5
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
-
Medium 6.3
SourceCodester Visitor Management System manage_user.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the…
-
Medium 6.5
Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker…
-
Medium 4.3
Lissy93 Dashy Configuration save access control
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It i…
-
Medium 4.3
Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privilege…
-
Medium 4.4
The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.…
-
Medium 5.9
Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor
Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above), A32.50 (b390 or above)
-
Medium 4.8
Reportico Cross-site Scripting vulnerability
Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).