CVE-2024-12832

Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit this...

CVE-2024-12832

Arista NG Firewall vulnerability CVE-2024-12832: ReportEntry allows SQL injection due to insufficient validation of a user-supplied string used to build queries, enabling arbitrary file read/write and potential code execution under www-data. Authenticated requirement; no concrete fix/version info...

CVE-2024-12829 Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability

Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within...

Online Class and Exam Scheduling System rank_update.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the parameter id of the file...

Online Class and Exam Scheduling System term.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter id of the file /pages/term.php. ...

kernel: stm class: Fix a double free in stm_register_device()

A vulnerability was found in the Linux kernel's stm class, where an improper memory management sequence in stmregisterdevice could lead to a double-free error. This issue occurs when the putdevice&stm-dev call triggers stmdevicerelease to free "stm", making the subsequent vfreestm call redundant...

Online Class and Exam Scheduling System room_update.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. Online Class and Exam Scheduling System has a SQL injection vulnerability that originates from a lack of sufficient input validation for the id parameter in the /pages/roomupdate.php file. No details of the...

Online Class and Exam Scheduling System teacher_save.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. Online Class and Exam Scheduling System has a SQL injection vulnerability that stems from a lack of sufficient input validation for the salut parameter in the file /pages/teachersave.php. No details of the...

USN-7166-2 linux-aws, linux-aws-5.15 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - ACPI...

CVE-2023-37940

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

PT-2024-12668 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.4.3.87 Liferay DXP versions 7.4 GA through update 87 Liferay DXP versions 7.3 GA through update 29 Description: A cross-site scripting XSS issue in the edit Service Access Policy page allows remote...

CVE-2023-37940: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

Liferay Portal cross-site scripting vulnerabilities

Liferay Portal is a J2EE-based portal solution from the US company Liferay. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and so on. A cross-site scripting vulnerability exis...

BIT-NODE-MIN-2023-30587

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the...

BIT-NODE-MIN-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

Vulnerabilities fixed in XWiki Platform

XWiki has fixed vulnerabilities in the XWiki Platform Specifically for versions 15.10.9 and 16.3.0. The vulnerabilities are in the way the XWiki Platform handles user permissions. A malicious user with programming privileges can execute code through the Extension Repository Application, or by...

CVE-2024-12490

A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teachersave.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely...

CVE-2024-12487

A vulnerability has been found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/roomupdate.php. The manipulation of the argument id leads to sql injection. The attack can be...

CVE-2024-12488

A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/subjectupdate.php. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2024-12489

A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/term.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The...