CVE Vulnerability Catalog

A critical vulnerability has been found in D-Link DAR-8000-10 up to version 20230819, related to argument manipulation in the file /log/decodmail.php, leading to OS command injection.

A vulnerability was found in TOTVS RM 12.1 that allows cross site scripting through manipulation of the argument 'd' in the Portal component. The attack can be launched remotely.

In XWiki Platform, it is possible to execute Velocity code without having script rights by creating an XClass with a property of type 'TextArea' and content type 'VelocityCode' or 'VelocityWiki'. In both cases, the code is executed regardless of the rights of the property author, which may lead to unauthorized access to data and APIs.

Version 0.95 of Catdoc was found to contain a NULL pointer dereference vulnerability in the xls2csv component at src/fileutil.c.

A critical vulnerability was found in Infosoftbd Clcknshop 1.0.0, affecting unknown processing of the file /collection/all in the GET Parameter Handler component. Manipulation of the argument tag leads to SQL injection.

Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.

Integer overflow or wraparound exists in the GitHub repository gpac/gpac prior to version 2.3-DEV.

There is an out-of-bounds read vulnerability in the GitHub repository gpac/gpac prior to version 2.3-DEV.

In the GitHub repository gpac/gpac prior to version 2.3-DEV, there is a floating point comparison bug using an incorrect operator.

SQL Injection vulnerability in Chamilo LMS versions 1.11 through 1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.

Multiple cross-site scripting (XSS) vulnerabilities in the Inventory Management System v1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.

A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.

A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.

The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notification.message parameter.

The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tasktyp parameter.

The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the executionBlockName parameter.

The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.

The Art Decoration Shortcode plugin versions <= 1.5.6 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.

The miniOrange YourMembership Single Sign On – YM SSO Login plugin versions up to 1.1.3 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.