17606 matches found
CVE-2024-26521
CE Phoenix v1.0.8.20 and earlier are affected by an HTML Injection vulnerability in the english.php component. The root cause is insufficient neutralization of special symbols, enabling a remote attacker to execute arbitrary code, escalate privileges, and access sensitive data. Affected versions ...
CVE-2024-27237
CVE-2024-27237 involves a logic error in wipe_ns_memory() within nsmemwipe.c that can cause an incorrect size calculation. This flaw permits local information disclosure without requiring elevated privileges or user interaction. The vulnerability is described across multiple sources (NVD/Red Hat/...
CVE-2024-27206
CVE-2024-27206 describes a potential out-of-bounds read caused by a missing bounds check, enabling remote information disclosure without privileges or user interaction. The connected sources reference this issue in the context of Google/Pixel Android security updates, but the provided documents d...
CVE-2024-28816
The CVE identifies a SQL injection in the Student Information Chatbot a0196ab, exposed via the login username parameter in index.php. The underlying flaw is unsanitized user input passed to a SQL query in the login function, enabling potential unauthorized access or data exposure. Exploitation st...
CVE-2024-2313
CVE-2024-2313 affects bpftrace (and related packages across several Linux distros). The issue arises when kernel headers must be extracted: bpftrace may load headers from a temporary directory, enabling an unprivileged user to force loading of compromised Linux headers. Local, high-privilege-seek...
realtyexecutivesplus.ca Cross Site Scripting vulnerability OBB-3869030
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-49341
CVE-2023-49341 affects Newland Nquire 1000 Interactive Kiosk (NQ1000-II_G_V1.00.011). The issue is cleartext credential storage in the backup.htm component that could allow remote attackers to obtain sensitive information. Root cause appears to be insecure credential storage in that component; de...
CVE-2024-23292
CVE-2024-23292 affects Apple platforms: macOS Sonoma 14.4, iOS 17.4, and iPadOS 17.4. The issue allows an app to access information about a user’s contacts due to inadequate data protection. The root cause is addressed in these updates with improved data protection, and Apple lists the fixed vers...
NDtaskmatic 1.0 SQL Injection
Title: NDtaskmatic-1.0-by-Mayuri.K Multiple-SQLi Author: nu11secur1ty Date: 03/07/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/17217/employee-management-system-php-and-mysql-free-download.html Reference: https://portswigger.net/web-security/sql-injection...
CVE-2023-41014
CVE-2023-41014 affects code-projects.org Online Job Portal 1.0. The vulnerability is a SQL Injection via the Username parameter for the “Employer” context, as described across multiple sources. The available documents do not specify a patched version or remediation steps. The root cause is not ex...
CVE-2023-52605
REJECTED CVE A NULL pointer dereference issue was identified in the Linux kernel within the ACPI subsystem's extlog module. In the extlogexit function, the extlogl1addr pointer was dereferenced before verifying if it was NULL, potentially causing system instability or crashes during the cleanup...
CVE-2024-2176
creationtimestamp| type| source ---|---|--- 2024-03-06 20:26:56+00:00| seen| https://t.me/ctinow/201766 2024-03-06 20:36:29+00:00| seen| https://t.me/ctinow/201787 2024-03-07 21:32:04+00:00| seen| https://t.me/ctinow/202796 2024-03-08 01:41:52+00:00| seen| https://t.me/arpsyndicate/4139...
CVE-2024-26624
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Jenkins AppSpider Plugin missing permission checks
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names...
CVE-2023-33875
creationtimestamp| type| source ---|---|--- 2024-03-06 13:11:39+00:00| seen| https://t.me/ctinow/201309 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...
BIT-VAULT-2020-7220
HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2...
BIT-MOODLE-2021-20283
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...