Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13468)

Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which is caused by a lack of validation of the id parameter of the itemeditsubmit.php file against externally entered SQL statements,...

PT-2024-1132 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 21.4R3 through 21.4R3-S4 Juniper Networks Junos OS versions 22.1R3 through 22.1R3-S3 Juniper Networks Junos OS versions 22.2R2 through 22.2R3-S1 Juniper Networks Junos OS versions 22.3 through 22.3R2-S2,...

CVE-2024-0333

Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. Chromium security severity: High...

Medium: tomcat9

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header siz...

CVE-2023-6493 Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save

The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

Ubystanitim University Information Management System Path Traversal Vulnerability

Ubystanitim University Information Management System is an information management system. A path traversal vulnerability exists in Ubystanitim University Information Management System version 30.11.2023, which stems from incorrect input validation leading to path traversal...

X.Org Server Damage Object Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Damage...

CVE-2023-6381

Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file file with SMB extension to a user via a link or email attachment and persuade the user to open the file...

Siemens SINEC INS Code Issue Vulnerability

Siemens SINEC INS is a software from Siemens Germany that provides centralized services for network infrastructure. A code issue vulnerability exists in Siemens SINEC INS that stems from an inability to properly validate responses received by the UMC server...

Siemens SINEC INS 信任管理问题漏洞

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. Siemens SINEC INS suffers from a Certificate Validation Improperity...

Tenda W30E formAdvancedSetListSet Function Buffer Overflow Vulnerability

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version V16.01.0.124843, which originates from a failure of the formAdvancedSetListSet function to correctly validate the length of the input data, and can be exploited by a remote...

Tenda AX9 /goform/SetNetControlList Interface Buffer Overflow Vulnerability

Tenda AX9 is a Wi-Fi 6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX9 version V22.03.01.46, which occurs when the "list" parameter of /goform/SetNetControlList fails to correctly validate the length of the input data, and can be exploited by a remote attacker to...

CVE-2023-48421

In gpupixelhandlebufferlivenessupdateioctl of private/google-modules/gpu/malikbase/platform/pixel/pixelgpuslc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User...

VulnCheck KEV: CVE-2023-26067

Certain Lexmark devices through 2023-02-19 mishandle Input Validation issue 1 of 4...

PT-2023-7415 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server version 11.5 CLI Description: The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to cause a deni...

CVE-2023-49095

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2...

SUSE-SU-2023:4612-1 Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: Update to OpenJDK 8u392 build 08 with OpenJ9 0.41.0 virtual machine - CVE-2023-22067: Fixed an IOR deserialization issue in CORBA bsc1216379. - CVE-2023-22081: Fixed a certificate path validation issue during client authentication...

PT-2023-32568 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress plugin for WordPress versions up to, and including, 1.0.76 Description: The issue is related to insufficient file validation on the bookingpress process upload function, allowing authenticated attackers with administrator-level...

PT-2023-7436 · Phoenix · Phoenix Securecore Technology

Name of the Vulnerable Software and Affected Versions: Phoenix SecureCore Technology version 4 Description: The issue is related to improper input validation in the processing of user-supplied splash screens during system boot. This could potentially allow an attacker to cause a denial-of-service...