Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
AFFECTED_PRODUCTS:
Canonical Authd
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TE Informatics Nova CMS allows SQL Injection.This issue affects Nova CMS: before 5.0.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /goform/formSetLog. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been...
AFFECTED_PRODUCTS:
Dlink Dir 619l Firmware
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/formSetDDNS. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclo...
AFFECTED_PRODUCTS:
Dlink Dir 619l Firmware
An attacker who successfully exploited these vulnerabilities could cause the robot to stop.
A vulnerability exists in the PROFINET stack included in the RobotWare versions listed below.Â
This vulnerability arises under specific condition when specially crafted message is processed by the system....
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2024-38365. Reason: This record is a duplicate of CVE-2024-38365. Notes: All CVE users should reference CVE-2024-38365 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instanc...
AFFECTED_PRODUCTS:
Bitcoin Bitcoin Core
A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formResetStatistic of the file /goform/formResetStatistic. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been...
AFFECTED_PRODUCTS:
Dlink Dir 619l Firmware
A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disc...
AFFECTED_PRODUCTS:
Dlink Dir 619l Firmware
A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. Th...
AFFECTED_PRODUCTS:
Dlink Dir 619l Firmware
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.
AFFECTED_PRODUCTS:
Seur Seur
In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API
AFFECTED_PRODUCTS:
Jetbrains Youtrack
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confi...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+9)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exp...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An admin attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exp...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attac...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attac...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitat...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confide...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integr...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity....
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integri...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issu...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitat...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confid...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integr...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+9)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+9)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integri...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories v...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scrip...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Expl...
AFFECTED_PRODUCTS:
Adobe Magento,
Adobe Magento,
Adobe Magento
... (+15)
Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier.
AFFECTED_PRODUCTS:
Zte Zxr10 1800 2s Firmware,
Zte Zxr10 2800 4 Firmware,
Zte Zxr10 3800 8 Firmware
... (+1)
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attac...
AFFECTED_PRODUCTS:
Linuxfoundation Zowe Api Mediation Layer
The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.
AFFECTED_PRODUCTS:
Linuxfoundation Zowe Api Mediation Layer,
Linuxfoundation Zowe Api Mediation Layer
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
AFFECTED_PRODUCTS:
Internet-Formation Wp Advanced Search
In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.
AFFECTED_PRODUCTS:
Openwebui Open Webui
Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark,
Wireshark Wireshark
ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Wireshark Wireshark
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries i...
AFFECTED_PRODUCTS:
Templateinvaders Ti Woocommerce Wishlist
The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to...
AFFECTED_PRODUCTS:
Wpuserplus Userplus
The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...
AFFECTED_PRODUCTS:
Essamamdani Advanced Blocks Pro