CVE-2024-24574

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side XSS. This vulnerability has been patched in version 3.2.5...

Design/Logic Flaw

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a...

The vulnerability of the LDAP protocol implementation in Mastodon’s web application for deploying distributed social networks allows a hacker to bypass the authentication process.

The vulnerability of the LDAP protocol implementation in Mastodon’s web application for deploying distributed social networks is related to the lack of a mechanism for verifying the source of data. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...

CVE-2024-24571

CVE-2024-24571 concerns the facileManager web application. Multiple connected sources confirm a systemic Cross-Site Scripting (XSS) vulnerability in versions 4.5.0 and earlier, arising from insufficient input validation in almost all input fields. The issue is described across NVD, Red Hat, CNVD/...

Code injection

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

Vulnerability fixed in Cisco Unified Communications and Contact Center

Cisco has fixed a vulnerability in Unified Communications Manager and Contact Center. A malicious party could exploit it to execute arbitrary code with permissions from the web application. It is not out of the question that this could give the malicious party gain the ability to execute code tha...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

VulnCheck KEV: CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

FreeBSD : opengrok -- Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. (1135e939-62b4-11ec-b8e2-1c1b0d9ea7e6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1135e939-62b4-11ec-b8e2-1c1b0d9ea7e6 advisory. - Vulnerability in OpenGrok component: Web App. Versions that are affected are 1.6.7 and prior. Easily...

DEBIAN-CVE-2023-5858

Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Low...

CVE-2023-46136 vulnerabilities

Vulnerabilities for packages: airflow, py3-werkzeug, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, airflow-core...

GHSA-HRFV-MQP8-Q5RW vulnerabilities

Vulnerabilities for packages: airflow, py3-werkzeug, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, airflow-core...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: k8s-sidecar, kubeflow-volumes-web-app, py3-cassandra-medusa, py3-pipenv, py3.13-scanner-test-libraries, nvidia-nsight-compute-13.1, py3-tensorflow-serving-api, request-1276, py3-torchvision-cuda-11.8, az, kubeflow-jupyter-web-app, kubeflow-katib, jwt-tool,...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: k8s-sidecar, kubeflow-volumes-web-app, py3-cassandra-medusa, py3-pipenv, py3.13-scanner-test-libraries, nvidia-nsight-compute-13.1, py3-tensorflow-serving-api, request-1276, py3-torchvision-cuda-11.8, az, kubeflow-jupyter-web-app, kubeflow-katib, jwt-tool,...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, py3-pipenv, az, kubeflow-katib, jwt-tool, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, kubeflow-volumes-web-app...

CVE-2023-45674

Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database including the user table. This issue may lead to Information Disclosur...

Sql injection

Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database including the user table. This issue may lead to Information Disclosur...

FarmBot Web App SQL Injection Vulnerability

FarmBot Web App is a web application. FarmBot Web App prior to version 15.8.4 suffers from an SQL injection vulnerability that stems from the presence of a SQL injection vulnerability that could allow an authenticated attacker to extract arbitrary data from its database, which could lead to...

CVE-2023-45674 SQL injection vulnerability in Farmbot-Web-App

Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows authenticated attackers to extract arbitrary data from its database including the user table. This issue may lead to Information Disclosur...