A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine.
AFFECTED_PRODUCTS:
Proges Thermoscan Ip
A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser.
AFFECTED_PRODUCTS:
Proges Sensor Net Connect Firmware V2
A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code.
AFFECTED_PRODUCTS:
Proges Sensor Net Connect Firmware V2
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authentica...
AFFECTED_PRODUCTS:
W3Eden Download Manager
Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a...
AFFECTED_PRODUCTS:
Adobe Acrobat
A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unknown code of the file signup.php of the component User Registration Handler. The manipulation of the argument user leads to cross site scripting. The attack can...
AFFECTED_PRODUCTS:
Adonesevangelista Online Blood Bank Management System
A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/index.php of the component Admin Login. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack r...
AFFECTED_PRODUCTS:
Adonesevangelista Online Blood Bank Management System
A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file register.php. The manipulation of the argument Email leads to sql injection. The attack may be initiated remotely. The exploit has been di...
AFFECTED_PRODUCTS:
Fabianros Online Bus Reservation Site
The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with S...
AFFECTED_PRODUCTS:
Tainacan Tainacan
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping....
AFFECTED_PRODUCTS:
Strategy11 Formidable Forms
A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file sort_user.php. The manipulation of the argument sort leads to cross site scripting. The attack can be initiated remotely. The exploit has...
AFFECTED_PRODUCTS:
Jkev Record Management System
A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. This affects an unknown part of the file entry.php. The manipulation of the argument school leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has...
AFFECTED_PRODUCTS:
Jkev Record Management System
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view_bill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The ex...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage_billing.php. The manipulation of the argument id leads to sql injection. The attack can be launched...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege
AFFECTED_PRODUCTS:
Dell Peripheral Manager
Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability, leading to arbitrary code execution on the system.
AFFECTED_PRODUCTS:
Dell Inventory Collector
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege
AFFECTED_PRODUCTS:
Dell Peripheral Manager
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege
AFFECTED_PRODUCTS:
Dell Peripheral Manager
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to...
A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an unknown function of the file /manage_block.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exp...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /request.php of the component Send Blood Request Page. The manipulation of the argument Address/bloodgroup leads to cross site s...
AFFECTED_PRODUCTS:
Adonesevangelista Online Blood Bank Management System
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area...
AFFECTED_PRODUCTS:
Haxx Libcurl
Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains an Out-of-bounds Read vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
AFFECTED_PRODUCTS:
Dell Bsafe Crypto C Micro Edition,
Dell Bsafe Micro Edition Suite,
Dell Bsafe Micro Edition Suite
A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument title/textarea leads to cross site scripting. It is possible to launch the...
AFFECTED_PRODUCTS:
Boltcms Bolt
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack...
AFFECTED_PRODUCTS:
Boltcms Bolt
A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
AFFECTED_PRODUCTS:
Bitdefender Gravityzone
A vulnerability classified as critical has been found in SourceCodester Establishment Billing Management System 1.0. This affects an unknown part of the file /manage_tenant.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /manage_payment.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotel...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
AFFECTED_PRODUCTS:
Ibericode Html Forms
The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
AFFECTED_PRODUCTS:
10Web Slider
The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
10Web Spidercontacts
The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Wanotifier Wanotifier
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occur...
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_block. The manipulation of the argument id leads to sql injection. The attack can...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exp...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql injection. The attack...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name leads to cross site scripting. The attack can be...
AFFECTED_PRODUCTS:
Oretnom23 Establishment Billing Management System
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+55)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products. After
obtaining the administrator's username and password, the attacker can send a
carefully crafted data packet to the interface with vulnerabilities, causing
the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+55)
A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument about leads to cross site scripting. It is possible to initiate the...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched r...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/manage_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. T...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System