CVE-2024-27668

CVE-2024-27668 affects Flusity-CMS v2.33 with a Cross-Site Scripting (XSS) vulnerability in the Custom Blocks feature. The attached CVSS 3.1 metrics indicate a Medium base score (6.1) with a network attack vector, low attack complexity, and no privileges required, but user interaction is required...

CVE-2024-27694

Vulnerability summary (CVE-2024-27694): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) flaw exposed at the endpoint /system/share/ztree_category_edit. Multiple sources indicate the issue stems from inadequate validation of whether a request originates from a trusted user. The Red Hat/CN...

CVE-2023-49969

Vulnerability summary : Customer Support System v1 suffers from a SQL injection in the id parameter of /customer_support/index.php?page=edit_customer. The root cause is a lack of validation of the id parameter, allowing crafted input to alter SQL statements and potentially access data. Impact and...

CVE-2024-25164

CVE-2024-25164 affects iDURAR v2.0.0. A path traversal vulnerability exists in the download function, allowing unauthenticated attackers to expose sensitive files. The Red Hat/NVD/CNNVD/etc. documents corroborate that the issue stems from a path traversal flaw in the download endpoint (example ex...

openSUSE: Security Advisory for the Linux Kernel RT (Live Patch 0 for SLE 15 SP5) (SUSE-SU-2023:3153-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-2151

CVE-2024-2151 affects SourceCodester Online Mobile Management Store 1.0, specifically the Product Price Handler where the quantity argument can be set to -1, leading to business-logic errors. The attack is remote and exploits have been disclosed publicly. The connected documents confirm the issue...

Sql injection

A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed ...

CVE-2024-2148

CVE-2024-2148 affects SourceCodester Online Mobile Management Store 1.0. The vulnerability is in the file /classes/Users.php, where manipulating the img argument enables unrestricted file upload. This claim is supported by multiple sources in the connected data and indicates a remote attack surfa...

CVE-2024-2147

SourceCodester Online Mobile Management Store 1.0 has a SQL injection in /admin/login.php caused by manipulating the username parameter. Descriptions from NVD/Red Hat and related feeds mark it as critical with remote exploitation and public disclosure (VDB-255500). No patch/version fix details ar...

Code injection

IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151...

Input validation

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396...

Design/Logic Flaw

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information. IBM X-Force ID: 248740...

CVE-2023-27291

IBM Watson CP4D Data Stores (CP4D Data Stores) versions 4.6.0–4.6.3 do not encrypt sensitive or critical information before storage or transmission, enabling potential exposure of data. The CVE-2023-27291 issue is documented in IBM Security Bulletin and corroborated by multiple feeds (NVD, Red Ha...

CVE-2022-43880

CVE-2022-43880 affects IBM QRadar WinCollect Agent 10.0–10.1.2. The issue is described as a denial of service caused by a vulnerability in the WinCollect Agent, with IBM classifying it as a server-side request forgery (SSRF) type weakness that could be exploited by a privileged user. Affected pro...

Cross site scripting

A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/update-tracker.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to launch the...

CVE-2024-0765

The CVE-2024-0765 entry concerns AnythingLLM where a default user on a multi‑user instance can call the /export-data endpoint, unzip/read the export, and exfiltrate system data at the saved state. The vulnerability relies on export functionality accessible to users with explicit system access at ...

CVE-2024-2145

CVE-2024-2145 affects SourceCodester Online Mobile Management Store 1.0. The vulnerability is a Cross-Site Scripting issue in an unknown function of /endpoint/update-tracker.php, triggered by manipulating the firstname parameter. It can be exploited remotely, and the exploit has been disclosed pu...

Cross site scripting

IBM Engineering Test Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

Code injection

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 27253...

CVE-2023-43054

CVE-2023-43054 affects IBM Engineering Test Management (ETM) 7.0.2 and 7.0.3. The flaw is a stored cross‑site scripting (XSS) vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted ses...