CVE Vulnerability Catalog

A critical vulnerability was found in the Byzoro Smart S85F Management Platform up to version 20230722. The issue affects some unknown processing of the file importhtml.php, where manipulation of the sql argument leads to command injection.

A vulnerability has been found in Academy LMS 6.0 that leads to cross site scripting attacks. The issue affects unknown code in the file /academy/home/courses, and manipulation of the argument query/sort_by allows for remote attacks.

A vulnerability has been found in PHP Jabbers Rental Property Booking 2.0 that allows cross site scripting attacks through manipulation of the index argument in the /index.php file. The attack can be launched remotely.

A vulnerability was found in PHP Jabbers Taxi Booking 2.0 that allows cross site scripting (XSS) attacks through manipulation of the index argument in the /index.php file. The attack can be launched remotely.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.

A vulnerability in PHP Jabbers Cleaning Business 1.0 allows for cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0, rated as problematic. This issue affects some unknown processing of the file /index.php, leading to cross-site scripting attacks.

A vulnerability was found in PHP Jabbers Service Booking Script version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.

A vulnerability was found in PHP Jabbers Shuttle Booking Software version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the /index.php file. The attack can be initiated remotely.

A race condition exists within a thread in the GitHub repository answerdev/answer prior to v1.1.1, which may lead to unpredictable application behavior.

Missing authorization in GitHub repository answerdev/answer prior to version 1.1.1 may lead to unauthorized access to resources.

A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 that allows cross-site scripting (XSS) attacks through manipulation of the index/pickup_id argument in the /index.php file.

An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.

In Control ID IDSecure versions 4.7.26.0 and prior, some API routes exist that exfiltrate sensitive information and passwords to users accessing these API routes.

SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature.

A segmentation violation was discovered in the ngiflib library via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.

In ngiflib version with commit fb271, a segmentation violation was discovered in the 'main' function at gif2tag.c. This vulnerability is triggered when running the gif2tga program.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

A Cross Site Scripting (XSS) vulnerability in the GatesAIr Flexiva FM Transmitter/Exciter FAX 150W allows a remote attacker to execute arbitrary code via a crafted script in the web application dashboard.

Certain F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, to generate the correct password.