457 matches found
CVE-2024-11240
A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.php of the component Banco de Dados Tab. The manipulation of the argument dbloginrole leads to cross site scripting. The attack may be...
DEBIAN-CVE-2024-51747
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its path entry in the projecthasfiles SQLite db...
CVE-2024-28061
An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file...
AnythingLLM 路径遍历漏洞
AnythingLLM is a document chatbot that meets business requirements. A path traversal vulnerability exists in AnythingLLM that stems from insufficient input validation and normalization when processing file and folder deletion requests, allowing an unauthorized attacker with a default role account...
ROS-20240404-14
The vulnerability of the library for controlling input/output to the terminal ncurses is related to the possibility of writing beyond the buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to impact the confidentiality, integrity, and availability of protected...
BIT-SQLITE-2021-45346
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries made via editing the Database File, it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain...
libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c
An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition...
libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c
An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition...
Huawei EulerOS: Security Advisory for ncurses (EulerOS-SA-2023-3438)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Information Disclosure
nautobot is vulnerable to Information Disclosure. The vulnerability exists because the library uses django-db-file-storage by default, and it does not require any user authentication to access the database file storage. This allows an attacker to view files in the database storage and potentially...
PT-2023-11905 · Rl Institut · Nesp2
Name of the Vulnerable Software and Affected Versions: rl-institut NESP2 version 1.0 Description: A critical issue has been found, allowing for sql injection through an unknown function in the file app/database.py. This can be exploited remotely. The issue has been publicly disclosed and a patch ...
NESP2 SQL Injection Vulnerability
NESP2 is a web map open source by Reiner Lemoine Institut. NESP2 suffers from a SQL injection vulnerability that stems from a SQL injection problem in app/database.py...
libreoffice: Arbitrary file write
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker...
RHEL 9 : ncurses (RHSA-2023:6698)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6698 advisory. The ncurses new curses library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses...
Medium: libreoffice
Issue Overview: A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. CVE-2023-1183 Affected Packages:...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE via the Microsoft.DiaSymReader.Native.amd64.dll file when reading a corrupted PDB file. Note: This issue only affects Windows systems. Remediation Upgrade Microsoft.NETCore.App.Runtime.win-x86 to version 6.0.22...
The vulnerability of the library for accessing and creating SQLite JDBC files is related to improper code generation. This allows an attacker to execute arbitrary code.
The vulnerability of the library for accessing and creating SQLite JDBC files is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Huawei EulerOS: Security Advisory for ncurses (EulerOS-SA-2023-2699)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
