Archive
16 June 2024
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
High 7.3
itsourcecode Real Estate Management System property-detail.php sql injection
A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file property-detail.php. The manipulation of the argument id leads to sql injection. The a…
-
Medium 6.3
itsourcecode Gym Management System manage_user.php sql injection
A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The atta…
-
Medium 6.3CVE-2024-6039 Public exploit
Feng Office Workspaces sql injection
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The e…
-
Medium 6.1
Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5CVE-2023-27636 Public exploit
Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
-
Critical 9.1
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many …
-
Critical 9.8
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution m…
-
Critical 9.8
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the ma…
-
Critical 9.8
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.
-
High 8.8
In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in I…
-
High 8.8
Xenforo before 2.2.16 allows CSRF.
-
High 7.8
langchain_experimental Code Execution via Python REPL access
langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
-
Critical 9.1
htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shel…
-
Critical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to …
-
Medium 6.2
C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, wh…
-
High 8.8
Xenforo before 2.2.16 allows code injection.
-
Medium 4.0
Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of …
-
High 7.5
Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, bec…
-
Medium 6.1
ExpressionEngine before 7.4.11 allows XSS.
-
High 7.5
irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.
-
Critical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLE…
-
Critical 9.1
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be ins…
-
High 7.5
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser AP…
-
Medium 4.9
SonarQube logs sensitive information
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
-
Critical 9.8CVE-2024-38396 Public exploit
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in…
-
Critical 9.8
Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.