Design/Logic Flaw

A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager ESM. The vulnerability could be remotely exploited...

Input validation

Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to...

CVE-2024-2067

SourceCodester Computer Inventory System 1.0 has a SQL injection vulnerability in /endpoint/delete-computer.php triggered by manipulating the computer parameter. The flaw is exploitable remotely and is considered critical by CVE-2024-2067; multiple sources report the exploit publicly. No official...

CVE-2023-50378

CVE-2023-50378 affects Apache Ambari prior to 2.7.8, where insufficient input validation and constraint enforcement enables stored cross-site scripting (XSS). This could allow attackers to access data, hijack sessions, or deliver malicious payloads. Remediation: upgrade to Ambari 2.7.8 or later (...

CVE-2024-2066

CVE-2024-2066 affects SourceCodester Computer Inventory System 1.0, with a Cross-Site Scripting (XSS) flaw in /endpoint/add-computer.php triggered via the model argument. The root cause is input manipulation that leads to XSS, allowing remote initiation. Several connected sources confirm the vuln...

CVE-2024-2065

CVE-2024-2065 affects SourceCodester Barangay Population Monitoring System up to v1.0. The vulnerable component is the file /endpoint/update-resident.php, where manipulating the full_name argument enables cross-site scripting. Descriptions across NVD, Red Hat, CVE-list and other sources confirm r...

Cross site scripting

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions...

Stack overflow

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generateconfrouter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Stack overflow

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Stack overflow

LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: erofs: fix lz4 inplace decompression Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actually not in-place I/O. However, like...

CVE-2024-24903

Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+ is affected by a weak password recovery mechanism. An adjacent-network, low-privilege attacker could exploit this flaw to retrieve a reset password token without authorization and change the target account’s password, leading to unau...

CVE-2024-24905

Dell Secure Connect Gateway (SCG) Policy Manager (all versions) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the inclusion store. An adjacent-network, high-privileged attacker could store malicious HTML/JavaScript, which executes in a victim’s browser in the context of the ...

Sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown processing of the file /admin/editcategories.php. The manipulation of the argument id leads to sql injection. The attack may be initiated...

Sql injection

A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/logincrud.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploi...

CVE-2024-24907

Dell Secure Connect Gateway (SCG) Policy Manager is affected by a Stored Cross-Site Scripting vulnerability in the Filters page across all versions. The root cause is improper handling/storage of user-supplied data in the data store, allowing an adjacent, high-privilege attacker to inject HTML/Ja...

CVE-2024-24906

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Policy page. The issue can be exploited by an adjacent-network, high-privileged attacker to store malicious HTML/JavaScript in a trusted data store, leading to e...

CVE-2024-2062

The CVE-2024-2062 entry concerns SourceCodester Petrol Pump Management Software 1.0. A SQL injection vulnerability is exposed in the /admin/edit_categories.php handler via the id parameter, with remote exploitation implied. Affected component is the server-side processing of that file; root cause...

CVE-2024-24900

Summary: CVE-2024-24900 concerns Dell Secure Connect Gateway (SCG) Policy Manager, across all versions, with an improper authorization vulnerability allowing an adjacent-network, low-privilege attacker to add unauthorized devices to policies, potentially causing information disclosure and unautho...

CVE-2023-39254

Dell Update Package (DUP) suffers an Uncontrolled Search Path vulnerability in versions prior to 4.9.10. A local attacker could potentially exploit this to execute arbitrary code with admin privileges. Affected product/component: Dell Update Package (DUP) framework. Root cause: uncontrolled searc...