A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter.
AFFECTED_PRODUCTS:
Phpgurukul Tourism Management System
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 297429
AFFECTED_PRODUCTS:
IBM Infosphere Information Server
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovp...
AFFECTED_PRODUCTS:
Gl-Inet Mt6000 Firmware,
Gl-Inet Xe3000 Firmware,
Gl-Inet X3000 Firmware
... (+25)
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by p...
AFFECTED_PRODUCTS:
Gl-Inet Mt6000 Firmware,
Gl-Inet Xe3000 Firmware,
Gl-Inet X3000 Firmware
... (+25)
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
AFFECTED_PRODUCTS:
Gl-Inet Mt6000 Firmware,
Gl-Inet Xe3000 Firmware,
Gl-Inet X3000 Firmware
... (+25)
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.
AFFECTED_PRODUCTS:
Zscaler Client Connector
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
AFFECTED_PRODUCTS:
Zscaler Client Connector
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
AFFECTED_PRODUCTS:
Zscaler Client Connector
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.
AFFECTED_PRODUCTS:
Zscaler Client Connector
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
AFFECTED_PRODUCTS:
Zscaler Client Connector
An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.
AFFECTED_PRODUCTS:
Zscaler Client Connector
A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of specia...
AFFECTED_PRODUCTS:
Datagear Datagear
K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference.
AFFECTED_PRODUCTS:
K7Computing K7 Ultimate Security
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input.
AFFECTED_PRODUCTS:
HP Poly Clariti Manager
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation.
AFFECTED_PRODUCTS:
HP Poly Clariti Manager
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.
AFFECTED_PRODUCTS:
HP Poly Clariti Manager
A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. The...
AFFECTED_PRODUCTS:
Automationanywhere Automation 360
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
AFFECTED_PRODUCTS:
Microweber Microweber
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
AFFECTED_PRODUCTS:
Hms-Networks Ewon Cosy\+ Firmware,
Hms-Networks Ewon Cosy\+ Firmware
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
AFFECTED_PRODUCTS:
SSH Privx,
SSH Privx,
SSH Privx
ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.
AFFECTED_PRODUCTS:
Devlop.systems Id4portais
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit h...
AFFECTED_PRODUCTS:
Juzaweb Cms
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely out...
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox Esr,
Mozilla Firefox Esr
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.
AFFECTED_PRODUCTS:
Mozilla Firefox
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Firefox Esr
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14...
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achiev...
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox Esr,
Mozilla Firefox Esr
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions.
*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.
AFFECTED_PRODUCTS:
Mozilla Firefox
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Firefox Esr
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Thunderbird
... (+2)
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Thunderbird,
Mozilla Firefox Esr
Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.
AFFECTED_PRODUCTS:
Opentext Arcsight Intelligence
Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.
AFFECTED_PRODUCTS:
Opentext Arcsight Intelligence
Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.
AFFECTED_PRODUCTS:
Opentext Arcsight Intelligence
In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
AFFECTED_PRODUCTS:
Jetbrains TeamCity
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in '/event/index.php'.
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the 'view' parameter in /candidate/index.php'.
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'.
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/eventwinner/index.php'.
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters i...
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' par...
AFFECTED_PRODUCTS:
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLe...
AFFECTED_PRODUCTS:
Janobe School Attendence Monitoring System,
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel...
AFFECTED_PRODUCTS:
Janobe School Attendence Monitoring System,
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/department/index...
AFFECTED_PRODUCTS:
Janobe School Attendence Monitoring System,
Janobe School Event Management System
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php...
AFFECTED_PRODUCTS:
Janobe School Attendence Monitoring System,
Janobe School Event Management System