231584 matches found
CVE-2024-25833
CVE-2024-25833 affects Field Logic DataCube3 v1.0. The available data describe an unauthenticated SQL injection vulnerability allowing an attacker to execute arbitrary SQL queries in the database. The vulnerability is rated critical (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Connected docu...
CVE-2024-27516
CVE-2024-27516 affects livehelperchat prior to version 4.34. The SSTI exists in the search parameter of lhc_web/modules/lhfaq/faqweight.php, enabling remote code execution and access to sensitive data. Impact is high (as per sources) including arbitrary code execution and data disclosure. Recomme...
CVE-2024-25867
CodeAstro Membership Management System (PHP v1.0) has a SQL Injection in add_type.php that allows remote SQL execution via membershipType and membershipAmount parameters. Affected component/file: add_type.php in Version 1.0. Underlying cause: improper input handling enabling arbitrary queries. Im...
CVE-2023-45874
CVE-2023-45874 affects Couchbase Server up to version 7.2.2. The issue is caused by a data reader that may cause a denial of service, leading to an outage of reader threads. The CVSS base score is 4.3 (Medium) with network attack vector and low privileges required. No exploitation details are pro...
CVE-2023-49930
CVE-2023-49930 affects Couchbase Server versions before 7.2.4. The issue is that cURL calls to the "/diag/eval" API endpoint are not sufficiently restricted, enabling access that could impact confidentiality, integrity, and availability. The vulnerability is described with a high severity (CVSS v...
CVE-2024-25350
CVE-2024-25350 affects PHPGurukul Zoo Management System 1.0, with a SQL Injection vulnerability in /zms/admin/edit-ticket.php exploitable via the tickettype and tprice parameters. The primary advisory cites a CVSS v3.1 base score of 9.8 (CRITICAL) with NETWORK attackVector, LOW attackComplexity, ...
CVE-2023-49932
CVE-2023-49932 affects Couchbase Server versions prior to 7.2.4. The vulnerability allows bypassing SQL++ N1QL cURL host restrictions. The available docs do not provide exploitation details; remediation is upgrading to 7.2.4+ or applying vendor guidance per release notes. CVSS 3.1 base score 5.4 ...
CVE-2024-24149
CVE-2024-24149 relates to a memory leak in libming 0.4.8, triggered by the function parseSWF_GLYPHENTRY, allowing denial of service via a crafted SWF file. Affected software: libming (C library for exporting Flash/SWF). Underlying impact per the entry: availability impact (DoS) with CVSS 3.1 vect...
CVE-2024-27913
FRRouting FRR’s CVE-2024-27913 affects ospf_te_parse_te in ospfd/ospf_te.c up to the 9.1 release. The issue allows remote attackers to crash ospfd (denial of service) via a malformed OSPF LSA packet, caused by an attempted access to a missing attribute field. Remediation: update to FRR 8.5.6 (per...
CVE-2024-22723
Webtrees 2.1.18 is affected by a Directory Traversal via the media_folder URL parameter, enabling an administrator to access files outside the intended media/ directory. The issue is documented across multiple sources (Red Hat, GHSA, OSV, NVD, CVE records). Affected component: media_folder handli...
CVE-2024-23302
CVE-2024-23302 affects Couchbase Server prior to version 7.2.4, where a private key leak occurs in the goxdcr.log. The available sources confirm the issue and the affected product/version, but do not provide exploit details or specific remediation steps beyond the exposure described. No root-caus...
CVE-2024-25831
Summary: CVE-2024-25831 concerns F-Logic DataCube3 v1.0 with a reflected XSS vulnerability caused by improper input sanitization. The issue allows an authenticated, remote attacker to execute arbitrary JavaScript in the web management interface. The Red Hat, JVN/JPCERT-related entries and multipl...
CVE-2023-50436
CVE-2023-50436 affects Couchbase Server prior to 7.2.4. The issue leaks admin credentials (ns_server) encoded in diag.log, with earliest affected version 7.1.5. Connected sources confirm the vulnerability is limited to 7.1.5–7.2.3 and that upgrading to 7.2.4 or later resolves the vulnerability. T...
CVE-2024-26302
ClearPass Policy Manager’s web-based management interface is affected by a vulnerability that could allow a remote attacker with low privileges to access sensitive information, potentially enabling further access to network services. The issue is addressed via Aruba Networks fixes; Aruba PSA 2024...
CVE-2024-26300
CVE-2024-26300 concerns Aruba/ClearPass Policy Manager: a vulnerability in the guest interface could allow an authenticated remote attacker to perform a stored XSS against an administrative user, with script execution in the victim’s browser within the affected interface context. The issue is des...
GHSA-GP6M-FQ6H-CJCX Magento LTS vulnerable to stored XSS in admin file form
Summary OpenMage is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Details MageAdminhtmlBlockSystemConfigFormFieldFile does not escape filename value in certain situations. Same...
Spoofing
In the Linux kernel, the following vulnerability has been resolved: sfc: farch: fix TX queue lookup in TX event handling We're starting from a TXQ label, not a TXQ type, so efxchannelgettxqueue is inappropriate and could return NULL, leading to panics...
Null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: sfc: adjust efx-xdptxqueuecount with the real number of initialized queues efx-xdptxqueuecount is initially initialized to numpossiblecpus and is later used to allocate and traverse efx-xdptxqueues lookup array. However, we may e...
Design/Logic Flaw
In the Linux kernel, the following vulnerability has been resolved: net/sched: schfrag: fix stack OOB read while fragmenting IPv4 packets when 'actmirred' tries to fragment IPv4 packets that had been previously re-assembled using 'actct', splats like the following can be observed on kernels built...