12,440 results · Clear filters · Feed
-
Low 3.1
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, …
-
Low 3.8
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are a…
-
Low 3.5
Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8…
-
Low 2.0
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are a…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7CVE-2024-9506 Public exploit
Regular Expression Denial of Service (ReDoS)
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
-
Low 3.1
Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Pr…
-
Low 3.5
Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products…
-
Low 3.5
Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products …
-
Low 3.5
Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products…
-
Low 2.4
SourceCodester Online Eyewear Shop Contact Information Page contact_info cross site scripting
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=system_info/contact_info of the component Contact Information Page. The manipulation of the …
-
Low 2.5
HCL BigFix Platform is affected by a DLL Hijack vulnerability
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances.
-
Low 2.0
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their reques…
-
Low 3.5
eLabFTW vulnerable to HTML Injection in extended search error message
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works …
-
Low 3.1
Jetty PushSessionCacheFilter can cause remote DoS attacks
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
-
Low 3.7
Jetty URI parsing of invalid authority
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of H…
-
Low 2.0
CSRF token leaked in URL parameters
Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.
-
Low 3.7
QileCMS Verification Code Forget.php sendEmail password recovery
A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password r…
-
Low 3.5
SourceCodester Online Eyewear Shop cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument Code leads to cross site script…
-
Low 2.4
Insecure Temporary File in `foxmarks`
foxmarks is a CLI read-only interface for Firefox's bookmarks and history. A temporary file was created under the /tmp directory with read permissions for all users containing a copy of Firefox's database of bookmarks, history, input history, visits counter, …
-
Low 3.7
H2O assertion failure when HTTP/3 requests are cancelled
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a De…
-
Low 3.1
H2O ignores headers configuration directives
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g…
-
Low 2.4
07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scripting
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component System Settings Page. The manipulation of the argument Login Interface Copyright leads…
-
Low 3.4
Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `…
-
Low 2.1
Lack of integrity check on the downloaded FRP client in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the r…
-
Low 2.3
Non-constant-time comparison when comparing hashes in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker co…
-
Low 2.3
The `is_in_or_equal` function may be bypassed in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `is_in_or_equal` function. This function, intended to check if a file resides within a given director…
-
Low 2.3
One-level read path traversal in `/custom_component` in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_component` endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio comp…
-
Low 2.3
The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker o…
-
Low 3.5
SourceCodester Record Management System sort2_user.php cross site scripting
A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file sort2_user.php. The manipulation of the argument qualification leads to cross site scr…
-
Low 2.4
Craig Rodway Classroombookings Session Page sessions cross site scripting
A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scriptin…
-
Low 3.5
Craig Rodway Classroombookings Room Page fields cross site scripting
A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page. The manipulation of the argument Name leads to cross site…