CVE-2023-7100

A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate leads to sql injection. It is possible to launch the attack...

(0Day) Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MonitorConsole class. The issue results from an exposed...

CVE-2023-48392

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, ...

Dell PowerProtect Data Domain Operating System Command Injection Vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. The Dell PowerProtect Data Domain is vulnerable to an operating system command injection vulnerability that stems from the inclusion of an...

The vulnerability of the IBM DB2 database management system, related to deficiencies in access control, allows a perpetrator to execute arbitrary commands.

The vulnerability of the IBM DB2 database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Denial Of Service (DoS)

phenx/php-svg-lib is vulnerable to Denial Of Service DoS. The vulnerability is caused due to a missing validation for circular references reached while parsing the attributes passed to a use tag inside an SVG document. An attacker can craft a malicious SVG file and send multiple request to a syst...

The vulnerability of the Weather component in operating systems such as watchOS, iPadOS, and iOS allows a hacker to disclose protected information.

The vulnerability of the Weather component in operating systems such as watchOS, iPadOS, and iOS is related to insufficient protection for registration data. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...

USN-6536-1: Linux kernel vulnerabilities

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some attributes passed from userspace. A local attacker could use this to cause a denial of service system crash or possibly expose sensitive information kernel memory. CVE-2023-39189 Kyle Zeng...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from an integer overflow in HLOS...

SourceCodester Online Quiz System Cross-Site Scripting Vulnerability

Online Quiz System is an online testing platform. A cross-site scripting vulnerability exists in SourceCodester Online Quiz System version 1.0, which stems from a cross-site scripting XSS vulnerability in the parameter quiztaker/yearsection...

Book Borrower System Cross-Site Scripting Vulnerability

Book Borrower System is a book borrowing system by the individual developer Remy Andrade. A cross-site scripting vulnerability exists in Book Borrower System version 1.0, which stems from an incorrect manipulation of the Book Title/Book Author parameter that can lead to cross-site scripting...

Shenzhen Youkate Industrial Facial Love Cloud Payment System Security Breach

Shenzhen Youkate Industrial Facial Love Cloud Payment System is a facial love cloud payment system from Shenzhen Youkate Industrial Shenzhen, China. A security vulnerability exists in Shenzhen Youkate Industrial Facial Love Cloud Payment System 1.0.55.0.0.1 and prior versions, which stems from an...

CVE-2023-45346

Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-20220

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. To exploit these vulnerabilities, the attacker must have valid device...

CVE-2023-46862

A null pointer dereference flaw was found in the Linux kernel's iouring functionality. This issue could allow a local user to crash the system...

CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS a...

Pharmacy Point Of Sale System Code Issue Vulnerability

Pharmacy Point Of Sale System is a web-based application by Carlo Montero, an individual developer. It is used to help a pharmacy manage its sales transactions. A security vulnerability exists in Pharmacy Point Of Sale System version 1.0 due to an unknown function in the profile of the component...

Security Bulletin: Vulnerability in CloudPak for Watson AIOps. [CVE-2023-41419]

Summary Gevent vulnerability was addressed in IBM Cloud Pak for Watson AIOps version 4.2.1. CVE-2023-41419 Vulnerability Details CVEID:CVE-2023-41419 DESCRIPTION: Gevent could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using...

CodeAstro Internet Banking System Cross-Site Scripting Vulnerability

CodeAstro Internet Banking System is a PHP online banking system from CodeAstro. A cross-site scripting vulnerability exists in CodeAstro Internet Banking System version 1.0, which originates from a cross-site scripting XSS vulnerability in the parameter accountnumber in the file...

CVE-2023-5421

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was...