CVE Vulnerability Catalog

Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. This issue has been addressed in release version 9.0.2108.

Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled with the cpo-settings including the 'n' flag. This issue leads to application crashes.

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure.

A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."

In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.

A vulnerability was found in Dreamer CMS up to version 4.1.3 that allows remote access to files or directories through manipulation of the file /upload/ueditorConfig?action=config. It is classified as problematic with a high complexity of attack.

A vulnerability has been found in TOTVS RM 12.1 that allows cross site scripting attacks through manipulation of the VIEWSTATE argument in the Login.aspx file. The attack can be executed remotely, but its complexity is high.

An issue was discovered in the default implementations of the `VolatileMemory` trait functions in a typical Virtual Machine Monitor (VMM), which may lead to out-of-bounds memory access. This affects users of custom `VolatileMemory` implementations that do not adhere to the `get_slice` documentation.

A vulnerability was found in Infosoftbd Clcknshop 1.0.0, leading to cross site scripting (XSS) attacks through manipulation of the argument q in the file /collection/all. The attack can be initiated remotely.

Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.

Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.

IBM Security Verify Information Queue versions 10.0.4 and 10.0.5 stores sensitive information in plain clear text, which can be read by a local user.

In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.

In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.

xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions.

There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository bookstackapp/bookstack prior to version 23.08. This allows attackers to send requests to internal server services, potentially leading to the exposure of sensitive information.

A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.

A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230816, concerning an unknown functionality of the file /sysmanage/licence.php. Manipulation of this functionality leads to improper access controls.

A vulnerability was found in the NeoMind Fusion Platform up to version 20230731, allowing cross site scripting (XSS) attacks through manipulation of the link argument in the /fusion/portal/action/Link file. The attack can be executed remotely.