A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_category. The manipulation of the argument name leads to cross site scripting. The atta...
AFFECTED_PRODUCTS:
Mayurik Best House Rental Management System
A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to path traversal. It is possible to launch the attack remotely. The exploit has been...
AFFECTED_PRODUCTS:
Oretnom23 Simple Forum\/discussion System
A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file /project/task/{task_id}/show. The manipulation of the argument comment leads to cross site scripting. The attack may be initiated remotely....
AFFECTED_PRODUCTS:
Workdo Crmgo Saas
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to th...
AFFECTED_PRODUCTS:
Workdo Crmgo Saas
Secure Email Gateway from Cellopoint has Buffer Overflow Vulnerability in authentication process. Remote unauthenticated attackers can send crafted packets to crash the process, thereby bypassing authentication and obtaining system administrator privileges.
AFFECTED_PRODUCTS:
Cellopoint Secure Email Gateway
The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoAuthentification' function. This makes it possible for unauthenticated attackers to make themselves administrators by registering with a usern...
AFFECTED_PRODUCTS:
Medialibs Webo Facto
An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution.
A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of the file updata.php. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t...
AFFECTED_PRODUCTS:
Code-Projects Crud Operation System
A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file showtest.php. The manipulation of the argument subid leads to sql injection. The attack may be initiated remotely. The exploit has been disc...
AFFECTED_PRODUCTS:
Fabianros Online Quiz Site
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access....
AFFECTED_PRODUCTS:
Zitadel Zitadel,
Zitadel Zitadel,
Zitadel Zitadel
... (+6)
Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions 2.6...
AFFECTED_PRODUCTS:
Zitadel Zitadel,
Zitadel Zitadel,
Zitadel Zitadel
... (+6)
Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API always r...
AFFECTED_PRODUCTS:
Zitadel Zitadel,
Zitadel Zitadel,
Zitadel Zitadel
... (+6)
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the `sendLocalReply()` in http async client,...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header opera...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access logge...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy w...
AFFECTED_PRODUCTS:
Envoyproxy Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-details.php of the component Comment Section. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely....
AFFECTED_PRODUCTS:
Mayurik Best Online News Portal
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the...
AFFECTED_PRODUCTS:
Jeanmarc77 123solar
A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file config/config_invt1.php. The manipulation of the argument PASSOx leads to code injection. The attack may be launched remotely. The exploit has bee...
AFFECTED_PRODUCTS:
Jeanmarc77 123solar
Rejected reason: Duplicate of CVE-2024-45806.
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to `XML External Entities` attack due to insecure defaults of the used Woodstox...
AFFECTED_PRODUCTS:
Gematik Reference Validator
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist...
AFFECTED_PRODUCTS:
Antfin Sofa Hessian
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 no...
AFFECTED_PRODUCTS:
Puma Puma,
Puma Puma
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify t...
AFFECTED_PRODUCTS:
Traefik Traefik,
Traefik Traefik
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authenti...
AFFECTED_PRODUCTS:
Linuxfoundation Dragonfly
A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploit...
AFFECTED_PRODUCTS:
Dlink Dar 7000 Firmware
A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFile_Load.do of the component Attachment Handler. The manipulation of the argument oid leads to improper access...
AFFECTED_PRODUCTS:
Jflow Project Jflow
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The explo...
AFFECTED_PRODUCTS:
Totolink T10 Firmware
An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code via uploading a crafted PHP file to the upload endpoint.
AFFECTED_PRODUCTS:
Closed-Loop Cless Server
Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.
AFFECTED_PRODUCTS:
Ergophone Tiptel Ip 286 Firmware,
Yealink Sip T28p Firmware
Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.
AFFECTED_PRODUCTS:
Couchbase Couchbase Server,
Couchbase Couchbase Server
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager Cloud Services Appliance
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page
AFFECTED_PRODUCTS:
Jetbrains Youtrack
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible
AFFECTED_PRODUCTS:
Jetbrains Youtrack
In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project
AFFECTED_PRODUCTS:
Jetbrains Youtrack
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site.
This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.
Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and...
AFFECTED_PRODUCTS:
Netcat Netcat Content Management System
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site.
This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.
Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and o...
AFFECTED_PRODUCTS:
Netcat Netcat Content Management System
A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks.
This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.
Apply patch from vendor https://n...
AFFECTED_PRODUCTS:
Netcat Netcat Content Management System
Microsoft Office Visio Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Visio,
Microsoft Office Long Term Servicing Channel
libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.
AFFECTED_PRODUCTS:
Freeimage Project Freeimage
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leadin...
AFFECTED_PRODUCTS:
Red Hat Openshift Container Platform,
Red Hat Openshift Container Platform,
Red Hat Single Sign On
... (+6)
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference...
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance. Afterw...
AFFECTED_PRODUCTS:
Google Reverb
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information.
AFFECTED_PRODUCTS:
Kastle Access Control System Firmware