17007 matches found
PT-2023-15306 · Unknown · The School Management – Education & Learning Management
Name of the Vulnerable Software and Affected Versions: The School Management – Education & Learning Management versions n/a through 4.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQ...
PT-2023-32446 · 1E · 1E Exchange End-User Interaction
Name of the Vulnerable Software and Affected Versions: 1E Exchange End-User Interaction product pack versions prior to 7.1 Description: The 1E-Exchange-DisplayMessage instruction does not properly validate the Caption or Message parameters, allowing for arbitrary code execution with SYSTEM...
PT-2023-35565 · Git +1 · Lcms
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported, involving functions such as cmsMLUsetWide, Type Text Description Read, and cmsReadTag...
AZL-34690 CVE-2023-47234 affecting package frr for versions less than 9.1-2
An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MPUNREACHNLRI attribute and additional NLRI data that lacks mandatory path attributes...
CVE-2023-25990
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10...
Command Injection
pip is vulnerable to Command Injection. While installing a package from Mercurial VCS URL, a specified mercurial URL could be used to inject arbitrary configuration options to the hg clone call. Controlling the Mercurial configuration can modify how and which repository is installed...
Cross Site Scripting
Reportico is vulnerable to Cross Site Scripting. The vulnerability is due to improper input sanitization in the project report title. The attacker can exploit this issue by injecting malicious JavaScript in the title field...
DEBIAN-CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
PT-2023-32436 · Teamamaze · Amazefileutilities
Name of the Vulnerable Software and Affected Versions: teamamaze/amazefileutilities versions prior to 1.91 Description: The issue is related to improper authorization. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...
CVE-2023-45024
Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...
CVE-2023-44271
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates o...
CVE-2023-41259
Best Practical Request Tracker RT before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call...
CVE-2023-41260
Best Practical Request Tracker RT before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls...
Denial Of Service (DoS)
wabt is vulnerable to Denial of Service DoS. The vulnerability occurs within the CWriter::MangleType function, resulting in a DoS...
OSV-2023-1101 Heap-buffer-overflow in decode_preR13_entities
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63776 Crash type: Heap-buffer-overflow READ 10 Crash state: decodepreR13entities decodepreR13 dwgdecode...
PT-2023-28691 · Dell · Dell Powerscale Onefs
Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.x through 9.5.0.x Description: The issue concerns an improper handling of insufficient permissions in Dell PowerScale OneFS. A low-privileged remote attacker could potentially exploit this to cause informati...
Cisco Firepower Management Center Software Arbitrary File Download Vulnerability
A vulnerability in the file download feature of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability is due to a lack of input sanitation. An attacker could exploit this vulnerability b...
Insecure Session Management
thorsten/phpmyfaq is vulnerable to Insecure Session Management. The vulnerability exists because the sessions are not securely handled which allows an attacker to perform unauthorized actions...
OSV-2023-1097 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63766 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...