231585 matches found
CVE-2024-1198
The CVE-2024-1198 entry concerns openBI up to 6.0.3. Affected is the function addxinzhi in application/controllers/User.php of the Phar Handler. Manipulation of the outimgurl argument leads to deserialization, enabling a remote attack. The vulnerability is actively discussed across multiple sourc...
CVE-2024-1195
CVE-2024-1195 pertains to iTop VPN (up to 4.0.0.1) with a vulnerability in the IOCTL Handler’s ITopVpnCallbackProcess.sys library. The issue arises from manipulation of an unknown functionality in this library, leading to denial of service. Vector is local access; attack complexity is low and pri...
CVE-2024-1194
CVE-2024-1194 affects Armcode AlienIP 2.41, specifically the Locate Host Handler component. The issue is a denial-of-service vulnerability (local access required) with an unknown root cause described as manipulating a function in that component. An exploit has been disclosed publicly. Public sour...
CVE-2024-1193
Navicat 12.0.29 is affected by a vulnerability in the MySQL Connection Handler component that can lead to a denial of service when a local attack is performed. The exploit has been disclosed publicly, and vendor responsiveness is unclear. The most concrete remediation noted in connected sources i...
CVE-2023-37531
The CVE-2023-37531 entry describes a cross-site scripting (XSS) vulnerability in the Web Reports component of the HCL BigFix Platform. The affected component is the Web Reports feature; the root cause is an XSS flaw that could allow a privileged user to inject malicious JavaScript into a form fie...
CVE-2023-37530
CVE-2023-37530 is an XSS vulnerability in the Web Reports component of the HCL BigFix Platform. The affected surface allows an attacker to inject and execute malicious JavaScript in a page used to retrieve cookie-stored information. The primary sources describe this as a cross-site scripting issu...
CVE-2023-37529
CVE-2023-37529 refers to a cross-site scripting (XSS) vulnerability in the Web Reports component of the HCL BigFix Platform. The affected component could allow an attacker to inject and execute malicious JavaScript in pages used to retrieve cookie information. The provided documents confirm the v...
CVE-2024-1191
Hyper CdCatalog 2.3.1 is affected by a vulnerability in the HCF File Handler that leads to denial of service. The issue is local in nature, with exploit information publicly disclosed and the vulnerability described across multiple sources (VDB-252681). Several connected documents corroborate the...
Design/Logic Flaw
A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encryption Passphrase Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to...
CVE-2024-1190
Global Scape CuteFTP 9.3.0.3 is affected by a vulnerability where manipulating the Host/Username/Password argument leads to a local denial-of-service. The issue is described across several sources (NVD, Red Hat, CNNVD, PRION/PT-Security) as affecting this version with local access required and pu...
Design/Logic Flaw
A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing of the component Registration Key Handler. The manipulation leads to denial of service. Local access is required to approach this attack. T...
CVE-2024-1187
Munsoft Easy Outlook Express Recovery 2.0 is affected by a vulnerability in the Registration Key Handler that leads to denial of service. The issue is triggered by specific processing in that component and requires local access to exploit. The exploit has been disclosed publicly. Mitigation/remed...
CVE-2024-1186
CVE-2024-1186 affects Munsoft Easy Archive Recovery 2.0, specifically the Registration Key Handler component. The issue allows denial-of-service via a local attack; the exploit has been disclosed publicly. The vendor reportedly did not respond to disclosure. No vendor-provided fix/version is deta...
CVE-2024-23635
CVE-2024-23635 affects AntiSamy prior to version 1.7.5, due to flawed HTML parsing when preserveComments is enabled, enabling potential mutation XSS. The connected IBM advisories confirm the issue and indicate the fix is to upgrade AntiSamy to 1.7.5 or newer. Practical impact is cross-site script...
Command injection
An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 2023/12/15 and later...
Command injection
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578...
Open redirect
open-irs is an issue response robot that reponds to issues in the installed repository. The .env file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets...
Input validation
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...