CVE Vulnerability Catalog

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2, allowing for the storage of malicious code.

A Server-Side Request Forgery (SSRF) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.2. This may lead to unauthorized access to internal server resources.

CVE-2023-3980 involves a Cross-site Scripting (XSS) vulnerability that is stored in the GitHub repository omeka/omeka-s prior to version 4.0.2.

A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and member fields.

An Open Redirect vulnerability has been found in IceWarp MailServer Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. An attacker can exploit this flaw to redirect users to a malicious website.

A vulnerability in the Kirby content management system related to the lack of password length limitation in authentication endpoints was discovered. Attackers could provide a password up to the server's maximum request body length, potentially leading to CPU and memory resource exhaustion.

A vulnerability exists in the Kirby content management system affecting versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It allows authenticated Panel users or external visitors to upload files with unknown extensions, potentially leading to the execution of malicious code in victims' browsers. The issue has been patched in newer versions of Kirby.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository jgraph/drawio prior to version 21.6.3.

A vulnerability in the Kirby content management system related to XML External Entities (XXE) exists in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. This vulnerability only affects Kirby sites that use the `Xml` data handler or the `Xml::parse()` method in site or plugin code.

The MF Gig Calendar plugin versions <= 1.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.

The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.

The wpShopGermany IT-RECHT KANZLEI plugin versions <= 1.7 has an authenticated stored Cross-Site Scripting (XSS) vulnerability.

The Gravity Master Custom Field for WP Job Manager plugin versions <= 1.1 has an authenticated (admin+) stored Cross-Site Scripting (XSS) vulnerability.

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized data modification due to insufficient restrictions on the 'apg_profile_update' function in versions up to and including 1.9. This allows authenticated attackers with subscriber-level permissions or above to arbitrarily update user metas.

The issue was addressed with additional permissions checks. An app may be able to access user-sensitive data.

A permissions issue was addressed with additional restrictions. An app may be able to modify protected parts of the file system.

A logic issue was addressed with improved checks in macOS and iOS. An app may be able to cause a denial-of-service.

The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.

A logic issue was identified in macOS that could allow apps to access user-sensitive data. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, and macOS Big Sur 11.7.9.

The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.