CVE-2023-43054

CVE-2023-43054 affects IBM Engineering Test Management (ETM) 7.0.2 and 7.0.3. The flaw is a stored cross‑site scripting (XSS) vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted ses...

Code injection

IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 283905...

CVE-2023-47745

CVE-2023-47745 affects IBM MQ Operator and related IBM MQ deployments. Affected: IBM MQ Operator versions and associated IBM MQ container images (Operator 21.0.x/23.0.x ranges; 2.2.x–2.4.x family; Cloud Pak variants) store or transmit user credentials in plain text, readable by a local user via t...

Design/Logic Flaw

An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo and postProcess methods...

Sql injection

SQL Injection vulnerability in MyPrestaModules "Product Catalog CSV, Excel Import" simpleimportproduct modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::construct and importProducts::addDataToDb methods...

CVE-2024-25016

CVE-2024-25016 affects IBM MQ and IBM MQ Appliance versions 9.0–9.3 (LTS/CD) and related IBM products. The issue is an improper buffering logic that could allow a remote unauthenticated attacker to cause a denial of service. Affected products include IBM MQ/Appliance across IBM App Connect Enterp...

CVE-2024-2135

The CVE-2024-2135 entry concerns Bdtask Hospital AutoManager (up to 20240223), specifically the Hospital Activities Page component and its /hospital_activities/birth/form handling. All connected sources describe a cross-site scripting vulnerability triggered by manipulating the Description argume...

CVE-2024-26469

Summary of CVE-2024-26469 : A Server-Side Request Forgery (SSRF) vulnerability exists in Tunis Soft’s PrestaShop productmodule “Product Designer” (productdesigner) before version 1.178.36. The root cause is an unsafe handling of the url parameter in the postProcess() method, enabling remote attac...

CVE-2024-25551

CVE-2024-25551 is a Cross Site Scripting (XSS) vulnerability affecting sourcecodester Simple Student Attendance System v1.0. A crafted GET request to the web application URL can allow an attacker to execute arbitrary code. Root cause details are not expanded beyond the XSS description in the prov...

CVE-2024-28084

CVE-2024-28084 affects iNet wireless daemon (IWD) p2putil.c up to version 2.15. The issue stems from initialization during parsing of advertised service information, enabling denial of service via daemon crash and possibly other unspecified impact. Fedora advisories indicate fixes in iwd 2.16 and...

CVE-2024-25847

CVE-2024-25847 describes a SQL injection in the PrestaShop ecosystem: the MyPrestaModules “Product Catalog (CSV, Excel) Import” (simpleimportproduct) module affects PrestaShop versions prior to 6.5.0. The root cause is an injection vulnerability exploitable through the Send::__construct() and imp...

Design/Logic Flaw

In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: wpcm450: fix out of bounds write Write into 'pctrl-gpiobank' happens before the check for GPIO index validity, so out of bounds write may happen. Found by Linux Verification Center linuxtesting.org with SVACE...

Path traversal

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfsgccachesubmitreaddata In nilfsgccachesubmitreaddata, brelsebh is called to drop the reference count of bh when the call to nilfsdattranslate fails. If the reference count hits 0 and it...

Open redirect

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Open redirect

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifsdemultiplexthread There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2isnetworknamedeleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd...

Race condition

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdteeclosesession There is a potential race condition in amdteeclosesession that may cause use-after-free in amdteeopensession. For instance, if a session has refcount == 1, and o...

Memory corruption

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc'ed for: sizeofstruct iwlnvmdata + sizeofstruct ieee80211channel + sizeofstruct ieee80211rate 'mvm-nvmdata' is a 'struct iwlnvmdata', so it is...

Cross site scripting

Cross-site Scripting XSS - DOM in GitHub repository langchain-ai/chat-langchain prior to 0.0.0...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommususpend The iommususpend syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFPKERNEL flag may re-enable IRQs during the suspend callback, which can cause...