Archive
7 September 2024
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Medium 4.3
code-projects Online Shop Store settings.php cross site scripting
A vulnerability classified as problematic was found in code-projects Online Shop Store 1.0. This vulnerability affects unknown code of the file /settings.php. The manipulation of the argument error leads to cross site scripting. The attack can be initiated re…
-
High 7.3
SourceCodesters Clinics Patient Management System print_diseases.php sql injection
A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /print_diseases.php. The manipulation of the argument disease/from/to leads to sql inject…
-
Medium 6.3
SourceCodester PHP CRUD update.php sql injection
A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update.php. The manipulation of the argument tbl_person_id/first_name/middle_name/last_name leads to sql …
-
Low 3.5
SourceCodester PHP CRUD update.php cross site scripting
A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site scripting. It…
-
Low 3.5
SourceCodester PHP CRUD Add.php cross site scripting
A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/Add.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site s…
-
Medium 6.3
SourceCodester PHP CRUD Delete Person delete.php sql injection
A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the component Delete Person Handler. The manipulation of the argument pers…
-
Medium 6.3
SourceCodester Simple Invoice Generator System save_invoice.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file /save_invoice.php. The manipulation of the argument invoice_code/customer/cashier/total_amount/disc…
-
Medium 4.7
SourceCodester Online Food Menu delete-menu.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the file /endpoint/delete-menu.php. The manipulation of the argument menu leads to sql injection. The attac…
-
High 8.1
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system wit…
-
Critical 9.9
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to r…
-
High 8.5
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitr…
-
Critical 9.9
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account o…
-
High 8.5
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead t…
-
High 7.8
A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to…
-
High 8.8
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service…
-
High 7.8
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alt…
-
High 8.8
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through …
-
High 7.8
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perfo…
-
High 8.3
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network t…
-
Critical 9.8
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…
KEV Oct 17, 2024 -
High 7.3
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
-
Critical 9.1
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…
-
High 7.5
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
-
Critical 9.0
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…
-
High 7.8
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remo…
-
High 7.4
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…
-
Medium 5.3
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…
-
High 8.1
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions…
-
Medium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when th…
-
High 7.5
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using…
-
High 7.7
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This …
-
High 7.5
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--al…
-
Low 3.3
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…
-
Medium 4.3
SourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in input
A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total…
-
Medium 6.3
SourceCodester Food Ordering Management System cancel-order.php sql injection
A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part of the file /foms/routers/cancel-order.php. The manipulation of the argument id leads to sql injection. It is possible to…
-
Medium 4.3
SourceCodester Clinics Patient Management System congratulations.php redirect
A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of the file congratulations.php. The manipulation of the argument goto_page leads to open redirect. It is…
-
High 7.5
IBM MQ security bypass
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
-
Medium 5.5
IBM MQ denial of service
IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault.
-
Medium 5.9
IBM Maximo Application Suite information disclosure
IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques.