CVE-2023-52357

Huawei HarmonyOS and Huawei EMUI contain a denial-of-service vulnerability in the vibration framework caused by a serialization/deserialization mismatch. The CNVD/CNNVD entries describe an availability impact, with exploitation likely local to the device. The NVD entry reiterates a serialization/...

CVE-2023-52387

The CVE-2023-52387 entry describes a Resource Reuse vulnerability in the GPU module that can affect confidentiality. Connected CNVD/CNNVD and related records map this issue to Huawei EMUI and Huawei HarmonyOS (mobile OSes) with a resource reuse flaw in the GPU component. The NVD/NVD-derived metri...

Open redirect

Rejected reason: This CVE was misassigned. See CVE-2023-47623 for the canonical reference...

Design/Logic Flaw

IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the current namespace. IBM X-Force ID: 237811...

Code injection

IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812...

Code injection

An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of files. IBM X-Force ID: 238535...

CVE-2022-41737

IBM Storage Scale Container Native Storage Access versions 5.1.2.1–5.1.7.0 allow a local attacker to initiate connections from a container outside the current namespace. The root cause is a namespace isolation weakness in CNSA that enables container-to-container access beyond the intended boundar...

CVE-2022-41738

IBM Storage Scale Container Native Storage Access vulnerability CVE-2022-41738 affects versions 5.1.2.1 through 5.1.7.0, enabling an attacker to initiate connections to containers from external networks. The issue is documented in the IBM Security Bulletin and related advisories (X-Force ID 23781...

Code injection

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279975...

Code injection

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279976...

Authorization

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747...

CVE-2022-42443

The CVE-2022-42443 issue affects IBM Trusteer Mobile SDKs: Trusteer iOS SDK prior to 5.7 and Trusteer Android SDK prior to 5.7. The vulnerability, described as an undisclosed issue that may allow file uploads, is supported by IBM Security Bulletin and corroborating entries in Red Hat, CVE listing...

CVE-2023-50951

CVE-2023-50951 affects IBM QRadar Suite and IBM Cloud Pak for Security. In some circumstances, the vulnerable software logs sensitive information about invalid authorization attempts, enabling potential information disclosure from logs. Affected: QRadar Suite versions 1.10.12.0–1.10.17.0 and Clou...

CVE-2024-22337

CVE-2024-22337 (IBM QRadar Suite and IBM Cloud Pak for Security) affects IBM QRadar Suite versions 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0, where potentially sensitive information stored in log files could be read by a local user. The root ca...

CVE-2024-22336

CVE-2024-22336 affects IBM QRadar Suite (1.10.12.0–1.10.17.0) and IBM Cloud Pak for Security (1.10.0.0–1.10.11.0). Root cause: information exposure by storing potentially sensitive data in log files readable by a local user. Impact is Confidentiality (high); no integrity/availability impact state...

Sql injection

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-0610

The CVE-2024-0610 entry concerns the Piraeus Bank WooCommerce Payment Gateway for WordPress. A time-based blind SQL Injection exists in the MerchantReference parameter across all versions up to and including 1.6.5.1, caused by insufficient escaping of user input and inadequate preparation of the ...

CVE-2024-1512

CVE-2024-1512 affects the MasterStudy LMS WordPress Plugin, all versions up to 3.2.5. The root cause is insufficient escaping and lack of proper SQL query preparation on the 'user' parameter of the /lms/stm-lms/order/items REST route, enabling union-based SQL injection. This allows unauthenticate...

Cross site scripting

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

Server side request forgery (ssrf)

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...