A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attack c...
AFFECTED_PRODUCTS:
Keerti1924 Secret Coder Php Project
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to initiate the attack remotely. The exploit...
AFFECTED_PRODUCTS:
Keerti1924 Php Mysql User Signup Login System
A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploi...
AFFECTED_PRODUCTS:
Keerti1924 Php Mysql User Signup Login System
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Li...
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Pgadmin Pgadmin 4
FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect...
AFFECTED_PRODUCTS:
Amazon Freertos
Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file.
An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters.
AFFECTED_PRODUCTS:
Oretnom23 Online Diagnostic Lab Management System
Microsoft Edge for Android Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge
Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.
AFFECTED_PRODUCTS:
Setorinformatica S.i.l.
The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary fil...
AFFECTED_PRODUCTS:
Booster Booster For Woocommerce
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wistia embed block in all versions up to, and including, 3.9.10 due to insuffic...
AFFECTED_PRODUCTS:
Wpdeveloper Embedpress
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass authentication restrictions for authorized user. IBM X-Force ID: 269409.
AFFECTED_PRODUCTS:
IBM Ds8900f Firmware,
IBM Ds8900f Firmware,
IBM Ds8900f Firmware
... (+1)
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to view sensitive log information after enumerating filenames. IBM X-Force ID: 269408.
AFFECTED_PRODUCTS:
IBM Ds8900f Firmware,
IBM Ds8900f Firmware,
IBM Ds8900f Firmware
... (+1)
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names.
AFFECTED_PRODUCTS:
IBM Ds8900f Firmware,
IBM Ds8900f Firmware,
IBM Ds8900f Firmware
... (+1)
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406.
AFFECTED_PRODUCTS:
IBM Ds8900f Firmware,
IBM Ds8900f Firmware,
IBM Ds8900f Firmware
... (+1)
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient i...
AFFECTED_PRODUCTS:
Wpdeveloper Embedpress
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...
AFFECTED_PRODUCTS:
Pagelayer Pagelayer
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
AFFECTED_PRODUCTS:
Red Hat Openshift Container Platform,
Red Hat Openshift Container Platform,
Red Hat Openshift Container Platform
... (+12)
The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to...
AFFECTED_PRODUCTS:
Unitedover Digits
The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level acces...
AFFECTED_PRODUCTS:
Acowebs Pdf Invoices And Packing Slips For Woocommerce
Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable launched from the application installation directory.
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.
AFFECTED_PRODUCTS:
Grafana Grafana,
Grafana Grafana,
Grafana Grafana
... (+2)
File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component.
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing...
AFFECTED_PRODUCTS:
MongoDB Mongodb,
MongoDB Mongodb,
MongoDB Mongodb
... (+2)
A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
AFFECTED_PRODUCTS:
Netgear Rax30 Firmware,
Netgear Rax30 Firmware
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.
AFFECTED_PRODUCTS:
Jfrog Artifactory
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
AFFECTED_PRODUCTS:
Jfrog Artifactory
Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload could be executed in the 'username' parameter.
AFFECTED_PRODUCTS:
Mozilo Mozilocms
Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions
AFFECTED_PRODUCTS:
Devolutions Workspace
Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions
AFFECTED_PRODUCTS:
Jetbrains Youtrack
In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
AFFECTED_PRODUCTS:
Jetbrains Youtrack
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
AFFECTED_PRODUCTS:
Jetbrains Youtrack
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2...
AFFECTED_PRODUCTS:
Themekraft Post Form
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media function in all versions up to, and i...
AFFECTED_PRODUCTS:
Themekraft Post Form
VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.
AFFECTED_PRODUCTS:
VMware Cloud Director
NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's adver...
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Fedoraproject Fedora
... (+1)
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att...
AFFECTED_PRODUCTS:
Booster Booster For Woocommerce
The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contrib...
AFFECTED_PRODUCTS:
Wpkoi Wpkoi Templates For Elementor
The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_rst_layout attribute of the nd_rst_search shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and...
AFFECTED_PRODUCTS:
Nicdarkthemes Restaurant Reservations
remote code execution in paddlepaddle/paddle 2.6.0
AFFECTED_PRODUCTS:
Paddlepaddle Paddlepaddle
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.
AFFECTED_PRODUCTS:
Jfrog Artifactory,
Jfrog Artifactory,
Jfrog Artifactory
... (+1)
Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.
AFFECTED_PRODUCTS:
Code-Projects Student Enrollment
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via /Employer/DeleteJob.php?JobId=1.
AFFECTED_PRODUCTS:
Code-Projects Online Job Portal
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."
AFFECTED_PRODUCTS:
Code-Projects Online Job Portal
Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*" which can be escalated to the remote command execution.
AFFECTED_PRODUCTS:
Oretnom23 Lost And Found Information System
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.
AFFECTED_PRODUCTS:
Phpgurukul Hospital Management System
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
AFFECTED_PRODUCTS:
Phpgurukul Hospital Management System
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.
AFFECTED_PRODUCTS:
Phpgurukul Hospital Management System