CVE Vulnerability Catalog

Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

Vulnerability in services related to early fingerprint APIs on HarmonyOS products. Successful exploitation of this vulnerability may lead to denial of service.

The Seed Fonts plugin versions up to 2.3.1 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.

The Beplus Sermon'e – Sermons Online plugin versions up to 1.0.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.

The Dylan James Zephyr Project Manager plugin versions <= 3.3.93 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The wpView plugin versions up to 1.3.0 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.

A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file, which may occur due to a non-existent path or a path requiring permissions, such as /dev/null, while specifying zones.

A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.

When recording the screen while in Private Browsing on Firefox for Android, the address bar and keyboard were not hidden, potentially leaking sensitive information. This bug only affects Firefox for Android and Focus for Android versions prior to 112.

In Apache Airflow, there is a vulnerability that may expose potentially sensitive values to users in certain situations. This issue affects versions from 2.5.0 before 2.6.2.

In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.

Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.

Eyoucms v1.6.2 has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web_recordnum parameter.

In elFinder before version 2.1.62, there is a path traversal vulnerability in the _joinPath method in elFinderVolumeLocalFileSystem.class.php, which may lead to unauthorized access to the file system.

A critical vulnerability has been found in the Agro-School Management System version 1.0, affecting some unknown functionality of the file loaddata.php. Manipulation of the argument subject/course leads to SQL injection.

A vulnerability CVE-2023-3308 has been identified in version 1.1.8 of the Aviator Template Engine in whaleal IceFrog. Manipulation of an unknown function leads to deserialization, which may be exploited by attackers.

A critical vulnerability was found in miniCal 1.0.0, affecting unknown processing of the file /booking/show_bookings/. Manipulation of the argument search_query leads to SQL injection.

The OpenZeppelin Contracts library, from version 4.7.0 to 4.9.2, contains a vulnerability that allows the construction of merkle trees enabling the forging of valid multiproofs for any set of leaves. The vulnerability occurs when using multiproof functions and the merkle tree contains a node with a value of 0 at depth 1.