Archive
January 2024
Vulnerabilities first published in this month (UTC), newest first.
1,235 results · Clear filters · Feed
-
Medium 5.5
PHPGurukul Hospital Management System change-password.php sql injection
A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The…
-
Medium 5.5
PHPGurukul Hospital Management System contact.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed t…
-
Medium 5.5
PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection
A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to s…
-
Medium 5.3
DeShang DSO2O install.php access control
A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The …
-
Medium 5.5
coderd-repos Eva HTTP POST Request page sql injection
A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads …
-
Medium 4.3
Mandelo ssm_shiro_blog Backend updateRoles access control
A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The ex…
-
Medium 6.1
A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker t…
-
Medium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker …
-
Medium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker …
-
Medium 5.5
MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvl…
-
Medium 5.3
D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers t…
-
Medium 6.5
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.
-
Medium 5.4
PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is…
-
Medium 6.1
Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
-
Medium 5.5
PHPGurukul Dairy Farm Shop Management System add-category.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit…
-
Medium 5.3
unknown-o download-station index.php path traversal
A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: '../filedir'. The attack…
-
Medium 5.3
HTML injection in email body through email subject
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inapprop…
-
Medium 4.3
SourceCodester Engineers Online Portal File Upload resource consumption
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the component File Upload Handler. The manipulation leads to resource consumption. It is possible to launch the …
-
Medium 6.5
Cri-o: pods are able to break out of resource confinement on cgroupv2
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servi…
-
Medium 4.3
CodeAstro Vehicle Booking System User Registration usr-register.php cross site scripting
A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Add…
-
Medium 5.5
soxft TimeMail check.php sql injection
A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclose…
-
Medium 4.3
CodeAstro Simple House Rental System Login Panel cross site scripting
A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launche…
-
Medium 6.3
Inis Sqlite.php sql injection
A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the p…
-
Medium 4.3
Parsing JSON serialized payload without protected field can lead to segfault
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereferenc…
-
Medium 4.4
Insertion of Sensitive Information into Log File in react-native-mmkv
react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone …
-
Medium 6.8
Microsoft Identity Denial of service vulnerability
Microsoft Identity Denial of service vulnerability
-
Medium 6.5
Windows Themes Spoofing Vulnerability
Windows Themes Spoofing Vulnerability
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Windows Cryptographic Services Information Disclosure Vulnerability
-
Medium 5.7CVE-2024-21306 Public exploit
Microsoft Bluetooth Driver Spoofing Vulnerability
Microsoft Bluetooth Driver Spoofing Vulnerability
-
Medium 5.7
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
-
Medium 6.1
Windows Server Key Distribution Service Security Feature Bypass
Windows Server Key Distribution Service Security Feature Bypass
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 6.5
Windows Message Queuing Client (MSMQC) Information Disclosure
Windows Message Queuing Client (MSMQC) Information Disclosure
-
Medium 4.9
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 6.6
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
-
Medium 5.3
Windows TCP/IP Information Disclosure Vulnerability
Windows TCP/IP Information Disclosure Vulnerability
-
Medium 4.4CVE-2024-21305 Public exploit
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability