CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability exists in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14. Remote attackers can inject arbitrary web scripts or HTML via a crafted payload injected into an App Builder custom object's 'Name' field.

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.1.0 through 7.3.0 and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 5. Attackers can inject arbitrary web scripts or HTML via a crafted payload in a form's `name` field.

EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.

Piwigo version 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the 'add tags' function.

An issue was discovered in KaiOS 3.0 and 3.1 where the binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed application. An attacker can make fetch requests to api-daemon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.

An issue was discovered in the Linux kernel before version 6.2.9 related to a use-after-free in the bq24190_remove function in bq24190_charger.c. This could allow a local attacker to crash the system due to a race condition.

An issue was discovered in Qt versions 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1 related to QDnsLookup, allowing for a buffer over-read via a crafted reply from a DNS server.

The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, allowing for a replay attack.

In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines do not properly mask passwords in member configuration, allowing Hazelcast Management Center users to view some secrets.

There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain.

Versions of Akka HTTP before 10.5.2 have a problem with the permissions of temporary files created during file uploads. These files have weak permissions, allowing other users to read them on Linux and UNIX systems.

Linux kernel 6.3 has a use-after-free vulnerability in the iopt_unmap_iova_range function in drivers/iommu/iommufd/io_pagetable.c.

Vulnerability in Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone, or video recording via the DYLD_INSERT_LIBRARIES flag.

Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit it, leading to unauthorized data access.

The Linux kernel before version 6.2.9 has a race condition and resultant use-after-free in emac.c if a physically proximate attacker unplugs an emac based device.

The Jenkins LoadComplete support Plugin version 1.0 and earlier does not escape the LoadComplete test name, leading to a stored XSS vulnerability.

The WSO2 Oauth Plugin for Jenkins version 1.0 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to trick users into logging into the attacker's account.

WSO2 Oauth Plugin for Jenkins version 1.0 and earlier does not invalidate the previous session on login.

A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.

The Tag Profiler plugin in Jenkins version 0.2 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to reset profiler statistics.