CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability exists in the LLVM library in the llvm::StringMap::insert function within ValueSymbolTable.cpp. The issue affects versions up to 22.1.6 and requires local access to exploit.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /insertbillingrecord.php. An attacker can remotely manipulate the patientid argument, leading to SQL injection. The exploit has been publicly disclosed.

A vulnerability has been found in SourceCodester Simple Food Ordering System 1.0 in the file /cart.php. Manipulation of the item_price argument can lead to business logic errors. The attack can be performed remotely and the exploit has been published.

A vulnerability in HCL DevOps Deploy / HCL Launch allows exposure of sensitive information in output logs. An attacker with access to the logs could potentially obtain sensitive values related to that step.

A vulnerability in the getfattr and setfattr utilities before version 2.6.0 allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files, leading to local privilege escalation when these tools are invoked by a privileged process over an attacker-controlled path.

A TOCTOU race condition vulnerability was found in the ACL library before version 2.4.0, allowing local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

A symlink traversal vulnerability was found in the libacl library before version 2.4.0 in pathname-based functions. A local attacker can replace any pathname component with a symbolic link, leading to privilege escalation by manipulating access control lists.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler. Authenticated attackers with SA_GLANALYTIC permission can inject malicious code into PARAM_2 and PARAM_3 POST parameters to execute arbitrary SQL queries.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler. An authenticated attacker can inject UNION SELECT payloads into the PARAM_0 POST parameter, extracting arbitrary database data including usernames, password hashes, and email addresses, which are then rendered into PDF report output.

A path traversal vulnerability in FrontAccounting before version 2.4.20 allows authenticated attackers to achieve remote code execution by uploading files with traversal sequences in the unique_name parameter. Attackers can write a PHP file outside the attachments directory into the web root, leading to arbitrary code execution.

The vulnerability in fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fails to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The normalize() and equal() functions return values that differ from a WHATWG-compatible URL parser, allowing bypass of host-based security policies.

A cross-site scripting vulnerability was found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php. Manipulating the full_name argument in the user registration endpoint allows remote script execution. The exploit is publicly available.

A SQL injection vulnerability has been detected in EyouCMS up to version 1.7.1 in the /index.php file of the API component. An attacker can remotely manipulate the click_like argument, leading to SQL injection. The exploit has been publicly disclosed and may be used.

A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.

A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /preview3.php file. An attacker can remotely manipulate the course_year_section argument, leading to SQL injection. The exploit is publicly available.

In SourceCodester Class and Exam Timetabling System 1.0, the file /edit_class1.php is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability in SzafirHost allows an attacker to inject a malicious native library into a JAR archive that is signed and verified. The signature verification uses a JarFile parser (reading the Central Directory), while extraction uses a JarInputStream parser (reading sequentially from local file headers). An attacker can insert a library entry between the last legitimate entry and the Central Directory, which is not seen by the signature verifier but is read and written by the extractor, leading to remote code execution.

A flaw was found in the vscode-java extension for Visual Studio Code, where it incorrectly trusts all Markdown content in JavaDoc hovers. A malicious Java file can hide commands, and if a user clicks a specially crafted link in a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands.