CVE Vulnerability Catalog

The macOS version of the DigiD app is not signed with Hardened Runtime. This allows a local process to load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the app, gaining access to DigiD data and cryptographic capabilities.

A vulnerability was found in SourceCodester Human Resource Management System 1.0 in the session_start function of controller/employee.php in the Employee Endpoint component. Manipulation of role/pfimg/EmpId arguments leads to improper authentication. The attack can be launched remotely and the exploit is public.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 in the MySQLDB::addNewUser function of include/database.php in the Registration Form component. Manipulation of the branch argument results in SQL injection. The attack is remotely possible and the exploit is public. The project has not responded.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 in the Session::checkLogin function of include/session.php in the Session Handler component. Manipulation of cookname/cookid arguments leads to incorrect comparison. The attack can be executed remotely and the exploit is public. The project has not responded.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.

A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.

A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges. Affects versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. A crafted HDF5 file with malicious grid metadata can cause memory corruption, leading to a heap-based buffer overflow and potential arbitrary code execution.

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization. Affects versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables. Affects versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A SQL injection vulnerability was identified in code-projects Online Reviewer System 1.0 in the file /reviewer/system/system/admins/manage/users/btn_functions.php within the User Update Handler component. Manipulation leads to SQL injection. The attack can be launched remotely. The exploit is publicly available.

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.