Archive
1 March 2024
Vulnerabilities first published on this day (UTC), newest first.
124 results · Feed
-
Medium 5.3
IBM FileNet Content Manager directory traversal
IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on …
-
Medium 6.3
IBM FileNet Content Manager privilege escalation
IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumstances. IBM X-Force ID: 271656.
-
Medium 5.3
IBM Cognos Command Center information disclosure
IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further attacks. IBM X-Force ID: 275038.
-
Medium 6.5
IBM Engineering Requirements Management cross-site request forgery
IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.
-
Medium 5.1
IBM Engineering Requirements Management information disclosure
IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 273336.
-
Medium 4.8
IBM Engineering Requirements Management cross-site scripting
IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…
-
High 7.8
MicroDicom DICOM Viewer Out-of-Bounds Write
MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior contain a lack of proper validation of user-supplied data, which could result in memory corruption within the application.
-
High 7.8
MicroDicom DICOM Heap-based Buffer Overflow
MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file…
-
High 7.8
Delta Electronics CNCSoft-B Stack-based Buffer Overflow
Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway list_ipAddressPolicy.php sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/list_ipAddressPolicy.php. The manipulation of the argument GroupId …
-
Medium 6.1
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive informati…
-
Medium 6.1
XSS sidekiq-unique-jobs UI server vulnerability
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.
-
Medium 6.1
mongo-express Cross-site Request Forgery vulnerability
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
-
Medium 6.1CVE-2023-49539 Public exploit
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…
-
High 7.5CVE-2023-49545 Public exploit
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive file…
-
Medium 6.1CVE-2023-49540 Public exploit
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…
-
Medium 4.9CVE-2023-49544 Public exploit
A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unau…
-
Critical 9.8CVE-2023-49543 Public exploit
Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute a…
-
Medium 6.1
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title co…
-
Medium 6.1
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle…
-
Medium 6.1CVE-2024-27743 Public exploit
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code…
-
High 7.5
phpseclib: guardrails needed on isPrime and randomPrime
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality chec…
-
Medium 6.5
LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_p…
-
High 7.5
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApLi…
-
Medium 6.5
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram functi…
-
High 8.8
Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php.
-
Medium 6.1
A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted scri…
-
High 7.5
phpseclib guardrails needed on OID length
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
-
Medium 6.1CVE-2024-27744 Public exploit
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code…
-
High 7.5
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_rou…
-
Medium 6.1
Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
-
Medium 6.5
Bagist Cross-site Scripting vulnerability
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
-
Medium 6.3
Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings…
-
Critical 9.8
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a cr…
-
High 8.8
Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.
-
Critical 9.8
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a …
-
High 7.5
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist f…
-
Medium 6.5
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn fu…
-
Critical 9.3CVE-2024-25293 Public exploit
mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.
-
High 8.8
Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote atta…