4517 matches found
PHP CRUD Cross-Site Scripting Vulnerabilities
PHP CRUD is a PHP-based implementation of add, delete, change and retrieve. A cross-site scripting vulnerability exists in PHP CRUD version 1.0, which stems from a cross-site scripting vulnerability contained in the firstname/middlename/lastname parameters of the /endpoint/Add.php file...
PHP CRUD Cross-Site Scripting Vulnerabilities
PHP CRUD is a PHP-based implementation of add, delete, change and retrieve. A cross-site scripting vulnerability exists in PHP CRUD version 1.0, which stems from a cross-site scripting vulnerability contained in the firstname/middlename/lastname parameters of the /endpoint/update.php file...
CVE-2024-41434
PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component Column.GetDecimal. This allows attackers to cause a Denial of Service DoS via a crafted input to the 'RemoveUnnecessaryFirstRow', it will check the expression between 'Agg' and 'GroupBy', but does not check the retu...
PT-2024-29395
Name of the Vulnerable Software and Affected Versions PingCAP TiDB version 8.1.0 Description The issue is related to a buffer overflow via the Column.GetDecimal component, which can be exploited to cause a Denial of Service DoS by providing a crafted input to the 'RemoveUnnecessaryFirstRow'...
Kashipara Hotel Management System security vulnerabilities
Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Hotel Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the userfname and userlname parameters of...
PT-2024-30139 · Unknown · Kashipara Hotel Management System
Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the "/core/signup user.php" endpoint of the system, allowing remote attackers to execute arbitrary code via the user fname and...
CVE-2024-41659 GHSL-2024-034: memos CORS Misconfiguration in server.go
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...
CVE-2024-41659 GHSL-2024-034: memos CORS Misconfiguration in server.go
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...
DEBIAN-CVE-2024-43818
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: Adjust error handling in case of absent codec device acpigetfirstphysicalnode can return NULL in several cases no such device, ACPI table error, reference count drop to 0, etc. Existing check just emit error message, b...
UBUNTU-CVE-2024-43818
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: Adjust error handling in case of absent codec device acpigetfirstphysicalnode can return NULL in several cases no such device, ACPI table error, reference count drop to 0, etc. Existing check just emit error message, b...
DEBIAN-CVE-2024-42304
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this...
UBUNTU-CVE-2024-42304
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this...
First logon of the day for any user takes extra time to enumerate resources
First logon of the day for any user takes extra time to enumerate the Applications\Desktop. Subsequent logon for the same user is quick...
PT-2024-38602 · Unknown · Codeastro Online Railway Reservation System
Name of the Vulnerable Software and Affected Versions: CodeAstro Online Railway Reservation System version 1.0 Description: A problem has been found in the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the arguments emp fname, emp lname, emp nat...
PT-2024-38601 · Unknown · Codeastro Online Railway Reservation System
Name of the Vulnerable Software and Affected Versions: CodeAstro Online Railway Reservation System version 1.0 Description: A problematic issue was found in the CodeAstro Online Railway Reservation System, affecting an unknown function of the file /admin/admin-add-employee.php of the component Ad...
SUSE CVE-2024-42126
In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmienter/nmiexit in real mode interrupt. nmienter/nmiexit touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling e.g. early HMI/MCE interrupt handler if percpu...
SUSE CVE-2024-42224
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 "net: dsa: mv88e6xxx: Support multiple MDIO busses" mv88e6xxxdefaultmdiobus has checked that the return value of listfirstentry is non-NULL. This appears...
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...
The first stage of the WER protocol is not SSL encrypted in Windows
The first stage of the WER protocol is not SSL encrypted in Windows Applies To Windows Server 2008 R2 Datacenter Windows Server 2008 R2 Enterprise Windows Server 2008 R2 for Itanium-Based Systems Windows Server 2008 R2 Foundation Windows Server 2008 R2 Standard Windows Server 2008 R2 Web Edition...
AZL-47379 CVE-2024-42224 affecting package kernel for versions less than 6.6.43.1-7
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 "net: dsa: mv88e6xxx: Support multiple MDIO busses" mv88e6xxxdefaultmdiobus has checked that the return value of listfirstentry is non-NULL. This appears...