12,440 results · Clear filters · Feed
-
Low 2.4
This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacke…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Low 2.4
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS …
-
Low 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, m…
-
Low 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ven…
-
Low 3.1
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access t…
-
Low 1.8
A stored XSS vulnerability has been discovered on OpenText™ Operations Agent (OA).
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. The XSS vulnerability could allow an attacker with local admin permissions to manipulate the content of the internal stat…
-
Low 3.5
Incorrect Session Creation with Desktop SSO
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
-
Low 2.2
CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or…
-
Low 2.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NA…
-
Low 3.5
Project Worlds Simple Web-Based Chat Application index.php cross site scripting
A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scr…
-
Low 3.5
code-projects Blood Bank Management System bloodrequest.php cross site scripting
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /bloodrequest.php. The manipulation of the argument msg leads to cross site scripti…
-
Low 2.4
PHPGurukul Vehicle Record System edit-brand.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-brand.php. The manipulation of the argument Brand Name leads to cross site scripting. It is possible …
-
Low 3.5
Poco-z Guns-Medical File Upload upload cross site scripting
A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site…
-
Low 3.6
GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When…
-
Low 2.9
Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in …
-
Low 3.5
SourceCodester Best House Rental Management System Manage Tenant Details index.php cross site scripting
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=tenants of the component Manage Tenant Details. The manipulation of the argume…
-
Low 3.6
HCL Sametime is impacted by generation of error messages containing sensitive information
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.
-
Low 1.2
Frappe Press possible HTML injection through SaaS Signup inputs
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who…
-
Low 3.5
Telestream Sentry Reports Page page cross site scripting
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /?page=reports of the component Reports Page. The manipulation of the argument z leads to cross sit…
-
Low 3.7
IBM Concert information disclosure
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute.
-
Low 2.4
code-projects Pharmacy Management System Manage Medicines Page manage_medicine.php cross site scripting
A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /manage_medicine.php of the component Manage Medicines Page. The manipulation of the …
-
Low 2.4
code-projects Pharmacy Management System Manage Customer Page manage_customer.php cross site scripting
A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /manage_customer.php of the component Manage Customer Page. The manipulation…
-
Low 2.4
code-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scripting
A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /manage_supplier.php of the component Manage Supplier Page. The manipulation of the argument address …
-
Low 3.5
PHPGurukul IFSC Code Finder Project search.php cross site scripting
A vulnerability has been found in PHPGurukul IFSC Code Finder Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file search.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The …
-
Low 3.5
PHPGurukul Boat Booking System Booking Details Page book-details.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/book-details.php of the component Booking Details Page. The manipulation of the argument Official Remark lea…
-
Low 3.5
PHPGurukul Boat Booking System Book a Boat Page book-boat.php cross site scripting
A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument phone_number leads to cros…
-
Low 3.5
code-projects Blood Bank System viewrequest.php cross site scripting
A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewrequest.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Th…
-
Low 3.7
jsbroks COCO Annotator Session predictable state
A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler. The manipulation of the argument SECRET_KEY leads to predictable from observable state. It is poss…
-
Low 2.7
Topdata Inner Rep Plus WebServer td.js.gz risky encryption
A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launche…
-
Low 2.7
Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking
A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRepPlus.html of the component Operator Details Form. The manipulation leads to missing password field …
-
Low 2.1
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts i…
-
Low 3.8
Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and …
-
Low 3.1CVE-2024-38820 Public exploit
CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
-
Low 3.3
Nokia SR OS: BOF File Encryption Vulnerability
Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content.
-
Low 3.5
Admidio vulnerable to HTML Injection In The Messages Section
Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.
-
Low 1.8
Multiple missing permission checks
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has …
-
Low 1.8
Multiple missing permission checks
Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered…
-
Low 3.0
Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). The supported ve…
-
Low 2.3
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…