12,440 results · Clear filters · Feed
-
Low 3.5
SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scripting
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Inventory Page. The manipul…
-
Low 1.8
Nextcloud Server User password is available in memory of the PHP process
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a …
-
Low 3.5
code-projects Farmacia adicionar-cliente.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.php. The manipulation of the argument nome/cpf/dataNascimento leads to cross site scripting. It is po…
-
Low 3.5
IBPhoenix ibWebAdmin Banco de Dados Tab database.php cross site scripting
A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.php of the component Banco de Dados Tab. The manipulation of the argument db_login_role leads to cros…
-
Low 3.5
Cross-site Scripting (XSS) in phpipam/phpipam
A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The a…
-
Low 2.4CVE-2024-46383 Public exploit
Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected…
-
Low 3.7
HCL Connections is vulnerable to a broken access control vulnerability
HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
-
Low 3.7
Apereo CAS login session expiration
A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an…
-
Low 3.1
Incorrect Ownership Assignment in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name mat…
-
Low 3.1
PostgreSQL libpq retains an error message from man-in-the-middle
Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human …
-
Low 3.1
IBM Security ReaQta cross-site scripting
IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste…
-
Low 2.1
PAN-OS: Server-Side Request Forgery in WildFire
A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.
-
Low 3.5
A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via t…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Proj…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via t…
-
Low 3.5
A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the userna…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 …
-
Low 3.5
A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the use…
-
Low 3.5
A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstnam…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.…
-
Low 3.5
A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0…
-
Low 3.8
Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated …
-
Low 3.4
Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a …
-
Low 3.9
Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service…
-
Low 3.9
Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to p…
-
Low 2.2
NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potenti…
-
Low 2.2
Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially e…
-
Low 3.4
Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before ver…
-
Low 3.8
Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated u…
-
Low 3.5
Public CMS Voting Management save cross site scripting
A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be …
-
Low 3.8
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb versi…
-
Low 2.2
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet Fo…
-
Low 3.9
An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAna…
-
Low 3.6
An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CW…
-
Low 2.7
DedeCMS friendlink_add.php unrestricted upload
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the …
-
Low 3.5
Element's thumbnails can be abused to misrepresent the content of an attachment
Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file d…