CVE Vulnerability Catalog

Minical version 1.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input validation in the application's user input handling in the security_helper.php file.

In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.

Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.

Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.

Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.

Tamale RMS version < 23.1 from Advent/SSC Inc. is vulnerable to Directory Traversal. An attacker can access contact information, including usernames, email addresses, and other internal data stored within the web app.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository admidio/admidio prior to version 4.2.8, allowing for the storage of malicious code.

A buffer overflow in EasyPlayerPro-Win versions from 3.2.19.0106 to 3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.

SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.

Versions 11 and later of emoncms have an information disclosure vulnerability that allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.

A critical vulnerability has been found in IBOS version 4.5.5, affecting the actionDel function in the file ?r=dashboard/approval/del. Manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in KylinSoft youker-assistant on KylinOS in the delete_file function in the dbus.SystemBus library of the Arbitrary File Handler component. Manipulation of this function leads to improper access controls.

A critical vulnerability has been found in KylinSoft youker-assistant on KylinOS in the function restore_all_sound_file, leading to path traversal: '../filedir'. Local exploitation is required.

A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the setMainSource function. Manipulation of this function leads to OS command injection.

A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the changedSource function. Manipulation of this function leads to improper access controls.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2 related to TLS certificate validation. The validation does not always consider whether the root of a chain is a configured CA certificate.

DokuWiki before version 2023-04-04a allows XSS via RSS titles.

Improper Access Control exists in GitHub repository nilsteampassnet/teampass prior to version 3.0.9.

A critical vulnerability has been found in the Agro-School Management System 1.0. Manipulation of the argument question_id in the doUpdateQuestion function of the btn_functions.php file leads to SQL injection.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function, allowing unauthenticated attackers to update post content and inject malicious JavaScript.