CVE Vulnerability Catalog

A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to CSV injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

Vulnerability in FULLBACK Manager Pro by GS Yuasa International Ltd. due to registering two Windows services with unquoted file paths. A user with write permission to the installation directory can execute arbitrary code with SYSTEM privileges.

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if they were saved by the job owner. The attacker must have permissions to access the jobs, but they were saved into the catalog service using the wrong owner permissions, potentially allowing saves into spaces where the attacker lacks write permissions.

A SQL Injection vulnerability was discovered in Philipinho Simple-PHP-Blog in the /edit.php file. The flaw can be exploited remotely and a public exploit is already available. The product uses a rolling release model, so no specific affected or fixed versions are disclosed.

A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.

App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

A permission control vulnerability in the window management module. Exploitation may impact system availability.

Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance via crafted XML payloads, causing a DoS condition. This issue affects MTC-9 from R22.1.1.0275 before R23.0.

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation is possible, and the exploit has been made public. The vendor was contacted but did not respond.

Race condition vulnerability in the audio module. Successful exploitation may affect availability.

Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Successful exploitation may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Successful exploitation may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Successful exploitation may affect availability.

Vitals ESP by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.

A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes SQL injection. The attack may be initiated remotely, and the exploit has been published and may be used.