12,440 results · Clear filters · Feed
-
Low 3.3
Divide-by-zero in Xpdf 4.04 due to very large page size
An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by…
-
Low 2.9
Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited…
-
Low 3.5
code-projects Agro-School Management System btn_functions.php doAddQuestion cross site scripting
A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects the function doAddQuestion of the file btn_functions.php. The manipulation of the argument Question leads to cross site…
-
Low 3.5
07FLY CRM User Profile cross site scripting
A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The e…
-
Low 3.5
mback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['RE…
-
Low 3.5
ruddernation TinyChat Room Spy Plugin room-spy.php wp_show_room_spy cross site scripting
A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site…
-
Low 3.3
In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
-
Low 3.5
Guangdong Pythagorean OA Office System Schedule cross site scripting
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description le…
-
Low 3.3
Stack buffer overflow in "read_file" function
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.
-
Low 3.3
Stack buffer overflow in "econf_writeFile" function
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.
-
Low 3.5
sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting
A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation…
-
Low 3.5
Stars Alliance PsychoStats login.php cross site scripting
A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiat…
-
Low 2.4
SourceCodester Lost and Found Information System Manage User Page cross site scripting
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipulation of the argument…
-
Low 3.7
Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service
A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time.
-
Low 3.5
yiwent Vip Video Analysis admincore.php cross site scripting
A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely…
-
Low 3.5
BeipyVideoResolution admincore.php cross site scripting
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. T…
-
Low 3.5
SourceCodester Local Service Search Engine Management System POST Parameter cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_area of the component POST Parameter Handler. The manipul…
-
Low 3.8
Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset
The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissio…
-
Low 3.5
Simplr Registration Form Plus+ Plugin cross site scripting
A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrad…
-
Low 2.4
BestWebSoft Twitter Plugin twitter.php twttr_settings_page cross site scripting
A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function twttr_settings_page of the file twitter.php. The manipulation of the argument twttr_url_twitt…
-
Low 2.7
In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host…
-
Low 3.5
Abstrium Pydio Cells Chat cross site scripting
A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. T…
-
Low 2.4
SourceCodester Students Online Internship Timesheet Syste cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argu…
-
Low 2.7
Image Optimizer by 10web < 1.0.27 - Admin+ Path Traversal
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
-
Low 3.5
MindSpore json_helper.cc UpdateArray memory corruption
A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corrupti…
-
Low 2.6
Error in calendar when booking an appointment reveals the full path of the website
Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3
-
Low 3.3
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with …
-
Low 3.3
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
Low 3.9
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_writ…
-
Low 3.7
An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session du…
-
Low 2.4
Webkul krayin crm Edit Person Page 2 cross site scripting
A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to…
-
Low 3.5
SourceCodester Comment System GET Parameter index.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file index.php of the component GET Parameter Handler. The manipulation of the argument msg leads to cross site scripting. It…
-
Low 3.5
Blind SSRF in the Nextcloud Mail app on avatar endpoint
Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.
-
Low 3.7
CraftCMS stored XSS in Quick Post widget error message
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clickin…
-
Low 3.3
The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download fai…
-
Low 3.7
AutoTools does not set CARES_RANDOM_FILE during cross compilation
c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow …
-
Low 3.7
NFine Rapid Development Platform CheckLogin weak hash
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown function of the file /Login/CheckLogin. The manipulation leads to use of weak hash. It is possible to launch the attack remot…
-
Low 2.6
Potential HTTP policy bypass when using header rules in Cilium
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints…
-
Low 3.3
FabulaTech USB for Remote Desktop IoControlCode 0x220408 null pointer dereference
A vulnerability was found in FabulaTech USB for Remote Desktop 6.1.0.0. It has been rated as problematic. Affected by this issue is the function 0x220448/0x220420/0x22040c/0x220408 of the component IoControlCode Handler. The manipulation leads to null pointer…
-
Low 3.3
EnTech Monitor Asset Manager IoControlCode 0x80002014 denial of service
A vulnerability was found in EnTech Monitor Asset Manager 2.9. It has been declared as problematic. Affected by this vulnerability is the function 0x80002014 of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible t…