CVE Vulnerability Catalog

A critical vulnerability was found in Intergard SGS version 8.7.0, affecting an unknown function. Manipulation of this function leads to permission issues and allows for remote attack.

IBM Robotic Process Automation for Cloud Pak versions 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information, which may be used to determine software vulnerabilities at the operating system level.

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer.

IBM Spectrum Protect versions 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to improper time-of-check to time-of-use functionality.

A critical vulnerability was found in Super Store Finder version 3.6, affecting an unknown functionality of the file /index.php in the POST Parameter Handler component. Manipulation of the 'products' argument leads to SQL injection.

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data. When exported to a CSV file, this data may attempt arbitrary command execution on the system used to open the file by spreadsheet software such as Microsoft Excel.

Vulnerability in Oracle Agile PLM (component: WebClient) version 9.3.6. A low-privileged attacker with network access via HTTP, requiring user interaction, can cause unauthorized update, insert, or delete of some data and unauthorized read of a subset. May impact additional products (scope change). CVSS 5.4.

A segmentation violation was discovered in the master branch of ChakraCore cbb9b via the function BackwardPass::IsEmptyLoopAfterMemOp().

A segmentation violation was discovered in the master branch of ChakraCore cbb9b via the function Js::EntryPointInfo::HasInlinees().

A segmentation violation was discovered in the ChakraCore master branch cbb9b via the function Js::ProfilingHelpers::ProfiledNewScArray().

A segmentation violation was discovered in the ChakraCore master branch cbb9b via the function Js::DiagScopeVariablesWalker::GetChildrenCount().

A stack overflow vulnerability was discovered in the ChakraCore master branch cbb9b via the function Js::ScopeSlots::IsDebuggerScopeSlotArray().

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.

The Hijiri Custom Post Type Generator plugin versions <= 2.4.2 has an authenticated (admin+) reflected Cross-Site Scripting (XSS) vulnerability.

A vulnerability in matrix-react-sdk allows for the injection of malicious code through the Export Chat feature, leading to stored XSS attacks. An attacker can exploit this flaw to leak message contents, although the impact is limited to code running from the `null` origin.

In DPA version 2023.2, an XSS attack was possible due to insufficient input validation.

The MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions <= 3.9.5 contains an authenticated (editor+) stored Cross-Site Scripting (XSS) vulnerability.

The Replace Word plugin by David Pokorny in versions <= 2.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The PluginPress Shortcode IMDB plugin versions <= 6.0.8 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The WPAdmin AWS CDN plugin versions up to 2.0.13 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of a logged-in user.