Cross site scripting

A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input alert"xss" leads to cross site scripting. It is possible to launch the...

Authentication flaw

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems...

Path traversal

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1709. Reason: This candidate is a duplicate of CVE-2024-1709. Notes: All CVE users should reference CVE-2024-1709 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2024-23346

CVE-2024-23346 affects pymatgen: the JonesFaithfulTransformation.from_transformation_str() method insecurely uses eval() on untrusted input, enabling arbitrary code execution during CIF parsing. This is tied to a vulnerability in the CIF parser path and is documented as a critical issue with a fi...

CVE-2024-20325

Cisco’s CVE-2024-20325 affects the Live Data server in Cisco Unified Intelligence Center. The issue arises from insufficient access control on cluster-configuration CLI requests, allowing an unauthenticated, local attacker to send privileged commands to specific directories and read/modify data i...

CVE-2023-46241

The CVE-2023-46241 entry concerns the discourse-microsoft-auth plugin for Discourse, which allows Microsoft-based authentication and can enable account takeovers when sites are configured to non-single-tenant accounts. The issue is linked to authentication handling within the plugin and has been ...

CVE-2024-1709

CVE-2024-1709 affects ConnectWise ScreenConnect (23.9.7 and earlier). It is an Authentication Bypass Using an Alternate Path or Channel that can grant direct access to confidential information or critical systems. Multiple sources indicate active exploitation and urge patching; ConnectWise releas...

CVE-2024-1474

WS_FTP Server prior to 8.8.5 is affected by reflected cross-site scripting in the administrative interface, arising from handling of various user-supplied inputs. The issue is documented across multiple sources as a vulnerability in WS_FTP Server versions before 8.8.5. A remediation action is to ...

CVE-2024-1701

CVE-2024-1701 affects keerti1924’s PHP-MYSQL-User-Login-System v1.0, with the vulnerability isolated to an issue in the /edit.php file that enables improper access controls. The attack is described as remote; the exploit has been disclosed publicly. Connected sources confirm the root cause relate...

Cross site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 256544...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTOTFMREQMAYBACKLOG flag on our requests to the crypto API, cryptoaeadencrypt,decrypt can return -EBUSY instead of -EINPROGRESS in valid situations. For...

CVE-2024-26585

Technical details for CVE-2024-26585 are not provided in the supplied connected documents. Public specifics (affected products, impact, and fixes) should be sought from official advisories and vendor notices.

CVE-2024-26584

CVE-2024-26584 is a Linux kernel vulnerability in the TLS crypto path affecting crypto_aead_encrypt/decrypt when CRYPTO_TFM_REQ_MAY_BACKLOG is used. Under valid backlogged conditions (e.g., full cryptd queue for AESNI), crypto_aead_{encrypt,decrypt} may return -EBUSY instead of -EINPROGRESS. In s...

CVE-2024-26582

CVE-2024-26582 is a Linux kernel vulnerability in the TLS subsystem. The issue stems from net/tls: tls_decrypt_sg not taking a reference on pages from clear_skb, which allows the put_page() in tls_decrypt_done to release those pages and trigger a use-after-free when reading a partially-read skb i...

CVE-2024-26583

CVE-2024-26583 — Linux kernel TLS race : The vulnerability arises in the TLS path where the async crypto notify may complete while the sending thread is exiting after calling complete(), risking access to data that may already be freed. The fix involves avoiding the race by removing problematic l...

CVE-2023-50955

IBM InfoSphere Information Server 11.7 is affected by CVE-2023-50955, an information-disclosure issue that could allow an authenticated privileged user to obtain the absolute path to the web server installation, aiding further attacks. Affected product/version: InfoSphere Information Server 11.7....

CVE-2023-33843

CVE-2023-33843 affects IBM InfoSphere Information Server 11.7. The vulnerability is a cross-site scripting in the Web UI, allowing injection of arbitrary JavaScript and potentially leading to credentials disclosure within a trusted session. IBM’s bulletin confirms the issue and provides remediati...

CVE-2023-47795

Summary: CVE-2023-47795 is a stored XSS vulnerability in the Document and Media widget of Liferay Portal 7.4.x (7.4.3.18–7.4.3.101) and Liferay DXP 2023.Q3 before patch 6, and in 7.4 update 18–92. The issue allows remote authenticated users to inject arbitrary script/HTML via crafting payloads in...

CVE-2023-7235

CVE-2023-7235 concerns the OpenVPN GUI installer prior to version 2.6.9, where the installation directory of OpenVPN binaries did not have proper access control when using a non-standard path. This weakness could allow an attacker to replace binaries and execute arbitrary code. The initial CVE en...