Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially crafted JavaScript payload in the upload functionality due to lack of proper sanitisation of JavaScript elements.
AFFECTED_PRODUCTS:
Neutronx Markdownx
A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql...
AFFECTED_PRODUCTS:
Zkteco Zkbio Media
A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to improper authorization. The attack may be ini...
AFFECTED_PRODUCTS:
Bdtask Hospital Automanager
A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This vulnerability affects unknown code of the file /billing/bill/edit/ of the component Update Bill Page. The manipulation leads to cross-site request forgery. The attack can be initiated rem...
AFFECTED_PRODUCTS:
Bdtask Hospital Automanager
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level...
AFFECTED_PRODUCTS:
Servit Affiliate Toolkit
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level acc...
AFFECTED_PRODUCTS:
Servit Affiliate Toolkit
Numbas editor before 7.3 mishandles reading of themes and extensions.
AFFECTED_PRODUCTS:
Numbas Editor
Numbas editor before 7.3 mishandles editing of themes and extensions.
AFFECTED_PRODUCTS:
Numbas Editor
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica...
AFFECTED_PRODUCTS:
Butlerblog Wp Members
A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cross site scripting. The attack may be laun...
AFFECTED_PRODUCTS:
Boyiddha Automated Mess Management System
A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0. Affected by this vulnerability is an unknown functionality of the file /member/chat.php of the component Chat Book. The manipulation of the argument msg leads to cross site scripting. The attack can...
AFFECTED_PRODUCTS:
Boyiddha Automated Mess Management System
A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0. Affected is an unknown function of the file /member/view.php. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been discl...
AFFECTED_PRODUCTS:
Boyiddha Automated Mess Management System
A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component Login Page. The manipulation of the argument useremail leads to sql injection. The attack may be initiated rem...
AFFECTED_PRODUCTS:
Boyiddha Automated Mess Management System
A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotel...
AFFECTED_PRODUCTS:
Boyiddha Automated Mess Management System
A vulnerability was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Setting/change_password_save of the component Password Reset Handler. The manipulation leads to cross-site r...
AFFECTED_PRODUCTS:
Bdtask G Prescription Gynaecology \& Obs Consultation
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the dat...
AFFECTED_PRODUCTS:
Archerirm Archer,
Archerirm Archer
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker could potentially obtain access to sensitive information via an internal URL.
AFFECTED_PRODUCTS:
Archerirm Archer
In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` .
AFFECTED_PRODUCTS:
Prestatoolkit Make An Offer\/offer Your Price
In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions.
AFFECTED_PRODUCTS:
Team-Ever Seo
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.
AFFECTED_PRODUCTS:
Cleanpresta Cd Custom Fields 4 Orders
The issue was addressed with improved checks. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. A malicious application may be able to access private information.
AFFECTED_PRODUCTS:
Apple Iphone Os,
Apple Tvos,
Apple Watchos
... (+1)
A permissions issue was addressed to help ensure Personas are always protected This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona.
AFFECTED_PRODUCTS:
Apple Visionos
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4. Processing malicious input may lead to code execution.
AFFECTED_PRODUCTS:
Apple macOS
This issue was addressed through improved state management. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An attacker with physical access may be able to use Siri to access sensitive user data.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Tvos
... (+2)
This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access information about a user's contacts.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Ipados
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Tvos
... (+2)
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Tvos
... (+2)
A lock screen issue was addressed with improved state management. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A person with physical access to a device may be able to use Siri to access private calendar information.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Iphone Os
... (+3)
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to elevate privileges.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Tvos
... (+2)
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. An app may be able to access user-sensitive data.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Watchos
... (+1)
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. Processing an image may lead to arbitrary code ex...
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
... (+7)
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regions of the disk.
AFFECTED_PRODUCTS:
Apple macOS
A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being...
AFFECTED_PRODUCTS:
Apple macOS,
Webkitgtk WebKitGTK,
Fedoraproject Fedora
... (+11)
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to access user-sensitive data.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
... (+2)
This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4. An app may be able to access sensitive user data.
AFFECTED_PRODUCTS:
Apple macOS
An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.
AFFECTED_PRODUCTS:
Apple macOS,
Webkitgtk WebKitGTK,
Fedoraproject Fedora
... (+8)
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
AFFECTED_PRODUCTS:
Apple macOS
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to break out of its sandbox.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple Iphone Os
... (+5)
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Iphone Os,
Apple Ipad Os
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
A race condition was addressed with additional validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access protected user data.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
This issue was addressed through improved state management. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Private Browsing tabs may be accessed without authentication.
AFFECTED_PRODUCTS:
Apple macOS,
Apple Safari,
Apple Iphone Os
... (+1)
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. A user may gain access to protected parts of the file system.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, tvOS 17.4. An app may be able to execute arbitrary code with kernel privileges.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
... (+3)
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system.
AFFECTED_PRODUCTS:
Apple macOS,
Apple macOS,
Apple macOS