CVE Vulnerability Catalog

In JetBrains TeamCity versions before 2023.05.2, it was possible to perform an XSS attack via GitHub integration.

In JetBrains TeamCity versions before 2023.05.2, a ReDoS attack was possible via integration with issue trackers.

In JetBrains TeamCity before version 2023.05.2, a token with limited permissions could be used to gain full account access.

Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.

The MaxButtons plugin versions up to 9.5.3 contain a Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above. An attacker can exploit this flaw to inject malicious JavaScript code.

The GrandSlambert Login Configurator plugin versions <= 2.1 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project, leading to resources that are unconstrained by the user's quota.

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message.

The 'Exposure of Resource to Wrong Sphere' vulnerability in Apache InLong (versions 1.4.0 to 1.7.0) allows an attacker to use general users to delete and update processes that should only be operable by admins.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the contactno argument in the /admin/edit-accepted-appointment.php file leads to SQL injection, which can be exploited remotely.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the contactno argument in the /admin/forgot-password.php file leads to SQL injection.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the editid argument in the /admin/del_service.php file leads to SQL injection, allowing for remote attacks.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. The issue affects some unknown processing of the file /admin/del_category.php, where manipulation of the argument id leads to SQL injection.

Pandoc versions before 3.1.6 allow arbitrary file write, which can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the 'pagedes' argument in the /admin/about-us.php file leads to SQL injection, allowing for remote attacks.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the 'cost' argument in the /admin/add-services.php file leads to SQL injection, which can be executed remotely.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the searchdata argument in the /admin/search-appointment.php file leads to SQL injection, which can be exploited remotely.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 0.1.0. Manipulation of the 'id' argument in the /admin/del_feedback.php file leads to SQL injection.

A critical vulnerability was found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the adminname argument in the /admin/admin-profile.php file leads to SQL injection, allowing for remote attack execution.

An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack.