Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that ver...
AFFECTED_PRODUCTS:
Icewhale Casaos Userservice
A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument image_name leads to unrestricted upload. It is possible to initiate the attack remotely....
AFFECTED_PRODUCTS:
Rems Image Accordion Gallery App
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
SQL injection vulnerability exists in GetDIAE_usListParameters.
AFFECTED_PRODUCTS:
Deltaww Diaenergie
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file...
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
In the Linux kernel, the following vulnerability has been resolved:
Fix memory leak in posix_clock_open()
If the clk ops.open() function returns an error, we don't release the
pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
Memory corruption while redirecting log file to any file location with any file name.
Memory corruption in Kernel while handling GPU operations.
Memory corruption while allocating memory for graphics.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics.
Transient DOS while decoding message of size that exceeds the available system memory.
Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions.
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption in SPS Application while requesting for public key in sorter TA.
A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit has...
Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme auxin-elements.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.7.
AFFECTED_PRODUCTS:
Averta Shortcodes And Extra Features For Phlox Theme
A vulnerability classified as problematic has been found in fridgecow smartalarm 1.8.1 on Android. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to...
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address_interpret.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.
AFFECTED_PRODUCTS:
Netentsec Ns Asg Firmware
A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic. Affected by this issue is some unknown functionality of the component Election Description Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to versi...
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This iss...
AFFECTED_PRODUCTS:
Bitdefender Antivirus,
Bitdefender Internet Security,
Bitdefender Total Security
... (+1)
Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app
In the Linux kernel, the following vulnerability has been resolved:
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
The dreamcastcard->timer could schedule the spu_dma_work and the
spu_dma_work could also arm the dreamcastcard->timer.
When the snd_pcm_substream is closing, the aica_c...
AFFECTED_PRODUCTS:
Debian Debian Linux,
Linux Linux Kernel,
Linux Linux Kernel
... (+7)
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: ljca: Fix double free in error handling path
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function ljca_auxdev_release
calls kfree(auxdev->dev.platform_data) to free the p...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to...
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
AFFECTED_PRODUCTS:
Themify Woocommerce Product Filter
Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AFFECTED_PRODUCTS:
Themify Woocommerce Product Filter
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
AFFECTED_PRODUCTS:
Themify Woocommerce Product Filter
The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.
AFFECTED_PRODUCTS:
Devpups Social Pug
In imgsys, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation Patch ID: ALPS08518692; Issue ID: MSV-1012.
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Linuxfoundation Yocto
... (+1)