A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+55)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.  After
obtaining the administrator's username and password, the attacker can send a
carefully crafted data packet to the interface with vulnerabilities, causing
the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+53)
A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
AFFECTED_PRODUCTS:
Dahuasecurity Nvr4416 16p 4ks2\/i Firmware,
Dahuasecurity Nvr4416 4ks2\/i Firmware,
Dahuasecurity Nvr4432 16p 4ks2\/i Firmware
... (+55)
A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument about leads to cross site scripting. It is possible to initiate the...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched r...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/manage_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. T...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /admin/index.php?page=manage_lot. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The e...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/view_reserved.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exp...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotel...
AFFECTED_PRODUCTS:
Oretnom23 Lot Reservation Management System
A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_save.php. The manipulation of the argument team leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabl...
AFFECTED_PRODUCTS:
Gaizhenbiao Chuanhuchatgpt
A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/menu.php of the component Add a Menu. The manipulation of the argument image leads to unrestricted upload. The attack may be launc...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/member_save.php. The manipulation of the argument last/first leads to sql injection. The attack can be launched remotel...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Affected is an unknown function of the file /admin/category_save.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0. This issue affects some unknown processing of the file /reservation_status.php. The manipulation of the argument rcode leads to sql injection. The attack may be initiated remotely. The expl...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
AFFECTED_PRODUCTS:
Elastic Kibana,
Elastic Kibana
A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. The manipulation of the argument rcode leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the pub...
AFFECTED_PRODUCTS:
Adonesevangelista Restaurant Management System
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta...
AFFECTED_PRODUCTS:
Siteorigin Siteorigin Widgets Bundle
Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
AFFECTED_PRODUCTS:
Alykoshin Mini Deep Assign
fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/...
In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
AFFECTED_PRODUCTS:
Dlink Dir 860l Firmware
D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
AFFECTED_PRODUCTS:
Dlink Dir 820lw Firmware
ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
AFFECTED_PRODUCTS:
Ais Strategyen
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
AFFECTED_PRODUCTS:
Chargeover Redoc
chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
AFFECTED_PRODUCTS:
Chasemoskal Snapstate
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
AFFECTED_PRODUCTS:
75Lb Deep Merge
Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.
AFFECTED_PRODUCTS:
Lukebond Json Override
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
AFFECTED_PRODUCTS:
Allpro Formmanager Data Handler
TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.
AFFECTED_PRODUCTS:
Google Tensorflow
In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations
AFFECTED_PRODUCTS:
Perforce Akana Api
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.
AFFECTED_PRODUCTS:
Perforce Akana Api
A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
AFFECTED_PRODUCTS:
Dbohdan Hicolor
A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
AFFECTED_PRODUCTS:
Dbohdan Hicolor
A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
AFFECTED_PRODUCTS:
Dbohdan Hicolor
A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
AFFECTED_PRODUCTS:
Dbohdan Hicolor
A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.
AFFECTED_PRODUCTS:
Dbohdan Hicolor
In versions of Akana API Platform prior to 2024.1.0Â a flaw resulting in XML External Entity (XXE) was discovered.
AFFECTED_PRODUCTS:
Perforce Akana Api
I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. An attacker can exploit this vulnerability by inserting a payload in the PDF notes that contains malicious code or script. This code will then...
A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
AFFECTED_PRODUCTS:
Wondercms Wondercms
An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.
AFFECTED_PRODUCTS:
Wondercms Wondercms
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
AFFECTED_PRODUCTS:
Langflow Langflow
A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoof the email identify of the sender.
A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC (or SPF or DKIM) policies.
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network servi...
AFFECTED_PRODUCTS:
Arubanetworks Clearpass Policy Manager,
Arubanetworks Clearpass Policy Manager,
Arubanetworks Clearpass Policy Manager
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `s...
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network servi...
AFFECTED_PRODUCTS:
Arubanetworks Clearpass Policy Manager,
Arubanetworks Clearpass Policy Manager,
Arubanetworks Clearpass Policy Manager