CVE-2023-38960

RaidenFTPD (Raiden Professional Server) 2.4 build 4005 is affected by an insecure permissions issue that can let a local attacker gain privileges and execute arbitrary code via a crafted executable in the installation directory. Multiple connected sources corroborate the same description, includi...

CVE-2023-52059

CVE-2023-52059 affects Gestsup v3.2.46 with a cross-site scripting (XSS) vulnerability in the Description text field. The underlying issue is likely insufficient input sanitization, enabling an attacker to inject arbitrary web scripts/HTML and potentially compromise a user session or page integri...

CVE-2022-48623

CVE-2022-48623 affects the Perl module perl-Cpanel-JSON-XS. The issue arises in Cpanel::JSON::XS (before 4.39-1) where out-of-bounds data handling can lead to information disclosure or a denial of service. The connected MARINER entry confirms the vulnerable range as

CVE-2023-52431

CVE-2023-52431 affects Plack::Middleware::XSRFBlock (Perl). The module prior to version 0.0.19 allows bypassing CSRF protection via an empty form value and an empty cookie when signed cookies are disabled. The vulnerability has a high impact in CVSS terms (C/H/I/A=High, exploitable remotely with ...

CVE-2023-49339

CVE-2023-49339 affects Ellucian Banner 9.17 (and earlier per sources) with an Insecure Direct Object Reference (IDOR) via a modified bannerId to /StudentSelfService/ssb/studentCard/retrieveData. Root cause: IDOR enabling potential unauthorized data access; CVSS 3.1 base score 6.5 (MEDIUM) with Co...

CVE-2024-24142

CVE-2024-24142 affects Sourcecodester School Task Manager 1.0. The issue is a SQL Injection in the GET parameter subject , caused by insufficient input handling. Impact is high (Confidentiality/Integrity/Availability) with CVSS v3.1 base score of 9.8 (NETWORK, LOW access complexity, NONE privileg...

Input validation

HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request an attacker could exploit this vulnerability to cause denial of service for affected users...

CVE-2024-24826

Summary (CVE-2024-24826): Exiv2, a C++ library for image metadata, contains an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder, affecting v0.28.1 (v0.28.0 introduced the vulnerable function). Reading metadata from a crafted video can crash the program. Versions before 0.28 are not affected...

Unrestricted file upload

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file...

Sql injection

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Information disclosure

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot...

Sql injection

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiersattribute parameter...

Deserialization of untrusted data

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function...

Design/Logic Flaw

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefineversion=3.7.7 where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest...

CVE-2024-1250

CVE-2024-1250 affects GitLab EE versions 16.8 through 16.8.1 (before 16.8.2). Affected component: group access token creation via a custom role with the manage_group_access_tokens permission. Root cause: privilege escalation arises when a user granted this permission can create group access token...

CVE-2024-1459

The CVE-2024-1459 entry concerns Undertow in Red Hat JBoss EAP, where a path-traversal bug allows a remote attacker to append a crafted sequence to an HTTP request and access privileged or restricted files. Root cause: improper validation of HTTP request paths in Undertow, enabling directory trav...

CVE-2024-25110

The CVE-2024-25110 entry concerns the UAMQP C library (Azure-uamqp-c submodule). The flaw occurs in open_get_offered_capabilities where a memory allocation may fail, causing a use-after-free that can lead to remote code execution if triggered during connection. A fix is to update the submodule to...

CVE-2021-4437

CVE-2021-4437 affects dbartholomae lambda-middleware frameguard

Code injection

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440...

Sql injection

Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information...