A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the web browser of a victim via the poll parameter in poll.php.
AFFECTED_PRODUCTS:
Msaad1999 Klik Socialmediawebsite
KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may allow remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' or 'validator' parameters of 'create-new-p...
AFFECTED_PRODUCTS:
Msaad1999 Klik Socialmediawebsite
A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web browser of a victim via the search parameter in offer.php.
AFFECTED_PRODUCTS:
Msaad1999 Klik Socialmediawebsite
A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.
AFFECTED_PRODUCTS:
Fullstackhero .net 9 Starter Kit,
Fullstackhero .net 9 Starter Kit
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
AFFECTED_PRODUCTS:
Mit Kerberos 5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
AFFECTED_PRODUCTS:
Mit Kerberos 5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
AFFECTED_PRODUCTS:
Mit Kerberos 5
Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data directory to an arbitrary room. The impact of the...
AFFECTED_PRODUCTS:
Element Element
Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbi...
AFFECTED_PRODUCTS:
Element Element
Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix.This issue affects Change Table Prefix: from n/a through 2.0.
AFFECTED_PRODUCTS:
Youngtechleads Change Table Prefix
Cross-Site Request Forgery (CSRF) vulnerability in Heureka Group Heureka.This issue affects Heureka: from n/a through 1.0.8.
AFFECTED_PRODUCTS:
Heureka Heureka
Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
AFFECTED_PRODUCTS:
Nuggethon Custom Order Status Manager For Woocommerce
F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database.
AFFECTED_PRODUCTS:
F-Logic Datacube3
F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.
AFFECTED_PRODUCTS:
F-Logic Datacube3
F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.
AFFECTED_PRODUCTS:
F-Logic Datacube3
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root...
AFFECTED_PRODUCTS:
F-Logic Datacube3 Firmware
yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Fedoraproject Fedora
... (+1)
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow...
AFFECTED_PRODUCTS:
Http-Swagger Project Http Swagger
texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted TTF file.
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unau...
AFFECTED_PRODUCTS:
Dpgaspar Flask Appbuilder
Possible path traversal in Apache OFBiz allowing authentication bypass.
Users are recommended to upgrade to version 18.12.12, that fixes the issue.
AFFECTED_PRODUCTS:
Apache OFBiz
XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.
AFFECTED_PRODUCTS:
Xenforo Xenforo
Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19.
AFFECTED_PRODUCTS:
W3Speedster W3speedster
Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/a through 2.1.20.
AFFECTED_PRODUCTS:
Tiny Setka Workflow
Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got an no audio track found error. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mp4 file.
AFFECTED_PRODUCTS:
Axiosys Bento4
A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
AFFECTED_PRODUCTS:
Libming Libming
A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
AFFECTED_PRODUCTS:
Libming Libming
A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
AFFECTED_PRODUCTS:
Libming Libming
A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
AFFECTED_PRODUCTS:
Libming Libming
Possible path traversal in Apache OFBiz allowing file inclusion.
Users are recommended to upgrade to version 18.12.12, that fixes the issue.
AFFECTED_PRODUCTS:
Apache OFBiz
The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.
Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via th...
AFFECTED_PRODUCTS:
Apache Xerces C\+\+
Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7.
AFFECTED_PRODUCTS:
Mandsconsulting Email Before Download
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The bl...
AFFECTED_PRODUCTS:
Dataease Dataease,
Dataease Dataease
Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
AFFECTED_PRODUCTS:
Couchbase Couchbase Server
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
AFFECTED_PRODUCTS:
5Kcrm Wukongcrm
Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component.
AFFECTED_PRODUCTS:
Sunkaifei Flycms
Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
AFFECTED_PRODUCTS:
Manuelaldape Parents \& Student Portal
VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.
AFFECTED_PRODUCTS:
VMware Workstation,
VMware Fusion
Inadequate content filtering leads to XSS vulnerabilities in various components.
AFFECTED_PRODUCTS:
Joomla! Joomla\!,
Joomla! Joomla\!,
Joomla! Joomla\!
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
AFFECTED_PRODUCTS:
Joomla! Joomla\!,
Joomla! Joomla\!
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
AFFECTED_PRODUCTS:
Joomla! Joomla\!,
Joomla! Joomla\!,
Joomla! Joomla\!
Inadequate parsing of URLs could result into an open redirect.
AFFECTED_PRODUCTS:
Joomla! Joomla\!,
Joomla! Joomla\!,
Joomla! Joomla\!
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
AFFECTED_PRODUCTS:
Joomla! Joomla\!,
Joomla! Joomla\!,
Joomla! Joomla\!
A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the Device Console UI of an affected device.
This vulnerab...
AFFECTED_PRODUCTS:
Cisco Imm Management Package
A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability exists because eBGP traffic is mapped to a shared hardware r...
AFFECTED_PRODUCTS:
Cisco NX-OS,
Cisco NX-OS,
Cisco NX-OS
... (+45)
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper handling of specific fiel...
AFFECTED_PRODUCTS:
Cisco NX-OS,
Cisco NX-OS,
Cisco NX-OS
... (+654)
A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.
This vulnerability i...
AFFECTED_PRODUCTS:
Cisco NX-OS,
Cisco NX-OS,
Cisco NX-OS
A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to unexpectedly restart, which could cause the device to stop processing network traffic or to reload.
This vulnerability is due to lack of pro...
AFFECTED_PRODUCTS:
Cisco NX-OS,
Cisco NX-OS,
Cisco NX-OS
... (+202)
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument password with the input nochizplz'+or+1%...
AFFECTED_PRODUCTS:
Surya2Developer Online Shopping System
A vulnerability, which was classified as problematic, was found in SourceCodester Online Learning System V2 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has...
AFFECTED_PRODUCTS:
Oretnom23 Online Learning System