CVE Vulnerability Catalog

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.

A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient error handling. An attacker could send a crafted file through the device, causing the analysis process to crash and resulting in DoS. Manual intervention may be required.

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This is due to incorrect feed update processing. An attacker could send traffic through an affected device that should be blocked, to bypass device controls and send traffic to protected systems.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This is due to insufficient input validation. Successful exploitation could result in unexpected processing of commands and unexpected output.

Cyclos 4 PRO version 4.14.7 and earlier does not validate user input in error messages, allowing a remote unauthenticated attacker to execute JavaScript code via an undefined enum constant.

A DOM-based Cross-site Scripting (XSS) vulnerability in the account registration process in Cyclos 4 PRO version 14.7 and earlier. A remote attacker can inject arbitrary web script or HTML via the groupId parameter.

A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to inject arbitrary web scripts or HTML via a crafted payload in /edit-db.php.

Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

Cross-site scripting (XSS) vulnerability in the Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8. Remote attackers can inject arbitrary web script or HTML via web content template names.

SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at booking.php.

A vulnerability in the Datagram TLS (DTLS) protocol implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization, resulting in a denial of service (DoS) condition. This is due to suboptimal processing when establishing a DTLS tunnel as part of an AnyConnect SSL VPN connection. An attacker could exploit this by sending a steady stream of crafted DTLS traffic, exhausting resources on the device.

An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'

An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.

An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.

Vulnerability in Oracle Agile PLM (component: Attachments) version 9.3.6. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized access to critical data or all accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impact).

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13 and 7.3 fix pack 2 do not properly check user permission when accessing a list of sites/groups. This allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before Service Pack 3. Remote attackers can inject arbitrary web script or HTML via the name of an asset category.