CVE Vulnerability Catalog

In Jami (version 20222284) by Savoir-faire Linux on Windows, there is improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.

The 'nickname' field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When present, these special characters prevent the application from creating the user's signature, resulting in a local denial of service.

A Cross-site Scripting (XSS) vulnerability exists in the DOM context in the GitHub repository plaidweb/webmention.js prior to version 0.5.5.

Wireshark versions 4.0.0 to 4.0.6 contain a bug in the iSCSI dissector that can lead to application crashes. An attacker can exploit this via packet injection or a crafted capture file to cause denial of service.

Wireshark versions 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 contain a vulnerability that can lead to a crash of the Kafka dissector. An attacker can exploit this via packet injection or a crafted capture file to cause a denial of service.

A heap buffer overflow was discovered in the libjpeg library in the LineBitmapRequester::EncodeRegion function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

A vulnerability in the libjpeg library was discovered that allows for a reachable assertion in the BitMapHook::BitMapHook method in bitmaphook.cpp. This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) via a crafted file.

GLPI is a free IT asset management software that has a SQL injection vulnerability in the dashboards administration panel. An administrator can trigger this vulnerability, potentially leading to unauthorized data access.

JS7 is an open-source job scheduler that allows users to upload files containing documentation. Specifically crafted file names can enable an XSS attack that injects code executed in the browser.

CVE-2023-37849 describes a DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8, allowing attackers to execute arbitrary code by placing a crafted DLL file in the same directory as PANDAVPN.exe.

CVE-2023-37598 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete new virtual fax function.

The Feedbacksystem stores passwords of users using LDAP login in clear text in the database. This issue occurs during the first login when the password is transmitted unencrypted.

Discourse, an open source discussion platform, has a nonce reuse vulnerability in its Content Security Policy (CSP) that could allow XSS attacks to bypass CSP protection. Currently, there are no known XSS vectors, but if one is discovered, this vulnerability would allow XSS attacks to completely bypass CSP.

cmark-gfm is an extended version of the C reference implementation of CommonMark, which has three polynomial time complexity issues. These issues may lead to unbounded resource exhaustion and subsequent denial of service.

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and Route parameters of /admin/router.php.

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port], and Mail Settings[auth] parameters of the /admin/configuration.php.

In ImpressCMS versions v1.4.5 and earlier, there is a cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the /editprofile.php component.

A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter of the /admin/contactus.php component.

An issue exists in YSoft SAFEQ 6 Server before version 6.0.82 related to modifying the LDAP server configuration URL. Changing from LDAPS to LDAP does not require re-entering the password, leading to the exposure of cleartext credentials.

A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Description of the /admin/aboutus.php component.