12,440 results · Clear filters · Feed
-
Low 3.5
code-projects Simple Admin Panel updateItemController.php cross site scripting
A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file updateItemController.php. The manipulation of the argument p_name/p_desc leads to cross site …
-
Low 3.5
code-projects Simple Admin Panel addSizeController.php cross site scripting
A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file addSizeController.php. The manipulation of the argument size leads to cross site scr…
-
Low 3.5
code-projects Simple Admin Panel addCatController.php cross site scripting
A vulnerability was found in code-projects Simple Admin Panel 1.0 and classified as problematic. This issue affects some unknown processing of the file addCatController.php. The manipulation of the argument c_name leads to cross site scripting. The attack may…
-
Low 3.6CVE-2024-56433 Public exploit
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 16553…
-
Low 3.7
Exposure of Sensitive Information Due to Incompatible Policies in GitLab
An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uplo…
-
Low 2.9
OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.
-
Low 2.5
Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux)…
-
Low 2.4
Portabilis i-Educar Tipo de Usuário Page 2 cross site scripting
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of the file /usuarios/tipos/2 of the component Tipo de Usuário Page. The manipulation of the argument n…
-
Low 3.5
code-projects Online Exam Mastering System sign.php cross site scripting
A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionality of the file /sign.php?q=account.php. The manipulation of the argument name/gender/college leads t…
-
Low 3.5
Emlog Pro common.php cross site scripting
A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /include/lib/common.php. The manipulation of the argument msg leads to cross site scripting. The attack can…
-
Low 2.0
Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access
Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
-
Low 3.3
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker ca…
-
Low 2.2
Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse
Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgr…
-
Low 3.5
code-projects Hostel Management Site room-details.php cross site scripting
A vulnerability was found in code-projects Hostel Management Site 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file room-details.php. The manipulation leads to cross site scripting. The attack can be initiated remot…
-
Low 2.4
SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modific…
-
Low 2.1
phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafe…
-
Low 3.5
itsourcecode Vehicle Management System billaction.php cross site scripting
A vulnerability was found in itsourcecode Vehicle Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /billaction.php. The manipulation of the argument extra-cost leads to cross site scripting. The attac…
-
Low 3.7
IBM Security Guardium Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to ob…
-
Low 3.1
HCL BigFix Inventory is affected by an access control vulnerability
An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.
-
Low 3.7
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended…
-
Low 3.3
Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0…
-
Low 3.7
InvoicePlane view session expiration
A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The comple…
-
Low 3.5
ruifang-tech Rebuild Task Comment Attachment Upload cross site scripting
A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment Attachment Upload. The manipulation leads to cross site scripting. It is possible to launch the attack…
-
Low 3.5
ruifang-tech Rebuild Project Task Comment cross site scripting
A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component Project Task Comment Handler. The manipulation leads to cross site scripting. The attack may be ini…
-
Low 3.7
funnyzpc Mee-Admin Login login observable response discrepancy
A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable response discrepancy. The…
-
Low 3.5
ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disa…
-
Low 3.5
WordPress Analytify plugin <= 5.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.1.0.
-
Low 3.5
WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1.
-
Low 3.5
Missing security header: Referrer-Policy URL
This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers.
-
Low 3.7
AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticate…
-
Low 3.1
Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through…
-
Low 3.5
SourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/client_data.php. The manipulation of the argume…
-
Low 2.4
ClassCMS Model Management Page admin cross site scripting
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scrip…
-
Low 3.3
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.2 and …
-
Low 3.3
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicato…
-
Low 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 1…
-
Low 2.0
GHSL-2024-111: Reflected XSS in /home in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker ca…
-
Low 3.7CVE-2024-12483 Public exploit
Dromara UJCMS User ID id authorization
A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack r…
-
Low 3.1
IBM InfoSphere Information Server information disclosure
IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.
-
Low 3.4
netrc and redirect credential leak
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …