CVE Vulnerability Catalog

A critical vulnerability has been found in the Lost and Found Information System version 1.0, affecting an unknown part of the file /classes/Master.php?f=save_item. Manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in SourceCodester Lost and Found Information System version 1.0. The issue affects an unknown functionality of the file /classes/Master.php?f=save_inquiry, where manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in AC Repair and Services System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=delete_inquiry leads to SQL injection.

PNP4Nagios version 0.6.26 has a stored XSS vulnerability in the AJAX controller via the basket API and filters.

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. An attacker may authenticate as another user when logging in as a user with SSO enabled, and any user account without a second factor enabled could be compromised.

Discourse is an open source discussion platform with a vulnerability that can cause a denial of service when attempting to create or update a custom sidebar section. This issue has been patched in commit `52b003d915`.

An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management (CFM) module of Juniper Networks Junos OS allows an adjacent attacker on the local broadcast domain to cause a Denial of Service (DoS) by sending malformed CFM packets.

An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.

The Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13, fixed in v.6.12.0.6 and v.6.13.0, allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.

A tampering vulnerability has been identified in Microsoft Edge for Android (Chromium-based) that could allow an attacker to make unauthorized changes to the application.

A vulnerability in Microsoft Edge for iOS allows spoofing, which may lead to information theft from users.

CVE-2023-36849 describes an improper check or handling of exceptional conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS. This allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS) by sending malformed LLDP packets.

A vulnerability in the periodic packet management daemon (PPMD) of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS) by sending malformed CFM packets. This leads to an FPC crash, resulting in sustained denial of service when CFM is configured on the interface.

A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS) by executing a specific L2VPN command.

A Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS). In a Multicast only Fast Reroute (MoFRR) scenario, the rpd process can crash when a specific low privileged CLI command is executed.

CVE-2023-36834 describes an Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series. An attacker can cause a Denial of Service (DoS) by sending a specific packet, leading to a loop in one of the Packet Processing Engines (PPE).

An Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS). Executing a specific CLI command by a low privileged user causes flowd to crash, leading to temporary traffic interruption.

A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). The 'aftman-bt' process crashes after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface.