A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads to sql injection. Th...
AFFECTED_PRODUCTS:
Oscommerce Oscommerce
Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.
AFFECTED_PRODUCTS:
Formalms Formalms
A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup ma...
AFFECTED_PRODUCTS:
Softwareag Webmethods,
Softwareag Webmethods
A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file /log/mailsendview.php. The manipulation of the argument file with the input /boot/phpConfig/tb_admin.txt leads to path traversal. The attack...
AFFECTED_PRODUCTS:
Byzoro Patrolflow Am 2530pro Firmware
A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php of the component HTTP POST Request Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be...
AFFECTED_PRODUCTS:
Byzoro Smart S210 Firmware
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Edge Chromium
A vulnerability was found in Byzoro S210 up to 20231121. It has been classified as critical. This affects an unknown part of the file /Tool/repair.php of the component HTTP POST Request Handler. The manipulation of the argument txt leads to sql injection. It is possible to initiate the attack remote...
AFFECTED_PRODUCTS:
Byzoro Smart S210 Firmware
A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php of the component HTTP POST Request Handler. The manipulation of the argument 1_file_upload leads to unrestricted upload. T...
AFFECTED_PRODUCTS:
Byzoro Smart S20 Firmware
Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to
versions 11.0.6 and 12.0.4
and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.
AFFECTED_PRODUCTS:
Johnsoncontrols Nae55 Firmware,
Johnsoncontrols F4 Snc Firmware,
Johnsoncontrols F4 Snc Firmware
... (+8)
Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc.
AFFECTED_PRODUCTS:
Struktur Libde265
Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc.
AFFECTED_PRODUCTS:
Struktur Libde265
Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc.
AFFECTED_PRODUCTS:
Struktur Libde265
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.
AFFECTED_PRODUCTS:
Struktur Libheif
libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.
AFFECTED_PRODUCTS:
Struktur Libheif
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.
AFFECTED_PRODUCTS:
Struktur Libheif
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.
AFFECTED_PRODUCTS:
Struktur Libheif
The affected ControlByWeb Relay products are vulnerable to a stored cross-site scripting vulnerability, which could allow an attacker to inject arbitrary scripts into the endpoint of a web interface that could run malicious javascript code during a user's session.
AFFECTED_PRODUCTS:
Controlbyweb X 332 24i Firmware,
Controlbyweb X 301 I Firmware,
Controlbyweb X 301 24i Firmware
Rejected reason: CVE request originates from private repository
Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
AFFECTED_PRODUCTS:
Tenda Ax3 Firmware
Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name.
AFFECTED_PRODUCTS:
Tenda Ax3 Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589.
AFFECTED_PRODUCTS:
Gpac Gpac
Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.
AFFECTED_PRODUCTS:
Gladysassistant Gladys Assistant
GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a denial of service.
AFFECTED_PRODUCTS:
Gpac Gpac
NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4).
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4).
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4).
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4).
AFFECTED_PRODUCTS:
Netscout Ngeniusone
NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability
AFFECTED_PRODUCTS:
Netscout Ngeniuspulse
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
AFFECTED_PRODUCTS:
Netscout Ngeniuspulse
NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
AFFECTED_PRODUCTS:
Netscout Ngeniuspulse
Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.
AFFECTED_PRODUCTS:
Ericsson Network Manager
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
AFFECTED_PRODUCTS:
Supermicro X11ssq Firmware,
Supermicro X11sra Firmware,
Supermicro X11sat Firmware
... (+359)
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeti...
AFFECTED_PRODUCTS:
Supermicro X11ssq Firmware,
Supermicro X11sra Firmware,
Supermicro X11sat Firmware
... (+359)
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitiv...
AFFECTED_PRODUCTS:
Supermicro X11ssq Firmware,
Supermicro X11sra Firmware,
Supermicro X11sat Firmware
... (+359)
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg.
AFFECTED_PRODUCTS:
Tenda W30e Firmware
Offline mode is always enabled, even if permission disallows it, in
Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and
earlier. This allows an attacker with access to the Workspace
application to access credentials when offline.
AFFECTED_PRODUCTS:
Devolutions Workspace