CVE Vulnerability Catalog

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.

PrestaShop prior to version 8.1.1 had an SQL injection vulnerability in the product search field on the product page in the admin panel. Version 8.1.1 includes a patch for this issue.

Cryptomator version 1.9.2 allows local privilege escalation for low privileged users via the `repair` function in the MSI installer. The issue arises from the MSI's repair function spawning a SYSTEM Powershell without the `-NoProfile` parameter, leading to the loading of the user's profile.

A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[1][data] leads to SQL injection, which can be exploited remotely.

Versions 0.2.15, 0.2.16, and 0.3.0 of the Vyper language have a flaw in the allocation of named re-entrancy locks, allowing cross-function re-entrancy in contracts. Version 0.3.1 contains a fix for this issue.

Netgear DGN3500 version 1.1.00.37 was found to have a buffer overflow vulnerability via the http_password parameter in setup.cgi.

In the kadm_rpc_xdr.c library in MIT Kerberos 5 before 1.20.2 and 1.21.x before 1.21.1, there is a bug related to freeing an uninitialized pointer. A remote authenticated user can trigger a kadmind crash.

A critical vulnerability was found in SourceCodester Inventory Management System 1.0, affecting an unknown part of the file catagory_data.php. Manipulation of the argument columns[1][data] leads to SQL injection.

A vulnerability in Microsoft Edge (Chromium-based) allows for a security feature bypass. An attacker could exploit this flaw to gain access to protected resources.

CVE-2023-38045 describes an improper neutralization of input during web page generation in the oneVote component for Joomla, allowing Cross-site Scripting (XSS) targeting non-script elements.

The MultiParcels Shipping for WooCommerce plugin before version 1.15.4 does not sanitize and escape various parameters before outputting them back on the page, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This can be exploited against high privilege users such as admins.

The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Quiz And Survey Master WordPress plugin before version 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting vulnerability.

The WP Shopping Pages plugin for WordPress through version 1.14 lacks CSRF checks in some places and is missing sanitization and escaping, which could allow attackers to make logged in admins add Stored XSS payloads via a CSRF attack.

A flaw was found in the Linux kernel's TUN/TAP functionality, which could allow a local user to bypass network filters and gain unauthorized access to some resources. The issues stem from incorrect or incomplete patches for CVE-2023-1076.

In Fujitsu Software Infrastructure Manager (ISM) before version 2.8.0.061, authorization credentials are insecurely collected and stored in cleartext in the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log. This occurs when users test the connection to a firmware repository or regularly authenticate against a configured remote firmware repository, if a backslash character is used in the user credentials (ID or password).

In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

In the vowifi service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.