Archive
October 2024
Vulnerabilities first published in this month (UTC), newest first.
135 results · Clear filters · Feed
-
Low 3.5
PHPGurukul IFSC Code Finder Project search.php cross site scripting
A vulnerability has been found in PHPGurukul IFSC Code Finder Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file search.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The …
-
Low 3.5
PHPGurukul Boat Booking System Booking Details Page book-details.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/book-details.php of the component Booking Details Page. The manipulation of the argument Official Remark lea…
-
Low 3.5
PHPGurukul Boat Booking System Book a Boat Page book-boat.php cross site scripting
A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument phone_number leads to cros…
-
Low 3.5
code-projects Blood Bank System viewrequest.php cross site scripting
A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewrequest.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Th…
-
Low 3.7
jsbroks COCO Annotator Session predictable state
A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler. The manipulation of the argument SECRET_KEY leads to predictable from observable state. It is poss…
-
Low 2.7
Topdata Inner Rep Plus WebServer td.js.gz risky encryption
A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launche…
-
Low 2.7
Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking
A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRepPlus.html of the component Operator Details Form. The manipulation leads to missing password field …
-
Low 2.1
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts i…
-
Low 3.8
Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and …
-
Low 3.1CVE-2024-38820 Public exploit
CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
-
Low 3.3
Nokia SR OS: BOF File Encryption Vulnerability
Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content.
-
Low 3.5
Admidio vulnerable to HTML Injection In The Messages Section
Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.
-
Low 1.8
Multiple missing permission checks
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has …
-
Low 1.8
Multiple missing permission checks
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered…
-
Low 3.0
Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). The supported ve…
-
Low 2.3
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Low 3.1
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, …
-
Low 3.8
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…
-
Low 3.5
Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8…
-
Low 2.0
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7CVE-2024-9506 Public exploit
Regular Expression Denial of Service (ReDoS)
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
-
Low 3.1
Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Pr…
-
Low 3.5
Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products…
-
Low 3.5
Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products …
-
Low 3.5
Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products…
-
Low 2.4
SourceCodester Online Eyewear Shop Contact Information Page contact_info cross site scripting
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=system_info/contact_info of the component Contact Information Page. The manipulation of the …
-
Low 2.5
HCL BigFix Platform is affected by a DLL Hijack vulnerability
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
-
Low —
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly
### Impact When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply: * They use Landloc…
-
Low 2.0
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their reques…
-
Low 3.5
eLabFTW vulnerable to HTML Injection in extended search error message
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works …
-
Low 3.1
Jetty PushSessionCacheFilter can cause remote DoS attacks
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.