CVE Vulnerability Catalog

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400.

In OpenVPN through 2.6.22 and 2.7.6, retransmissions of ACK packet ID allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow.

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address.

Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme.

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined and depends on the linker-assigned BSS layout of the specific firmware build.

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.

A weakness has been identified in jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. An unknown function in file travel/src/main/java/com/controller/CommonController.java of component CommonDao is affected. Manipulating arguments table/column/xColumn/yColumn can lead to SQL injection. The attack can be launched remotely and the exploit has been made public. The product does not use versioning, but a patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 involving an unknown function of the file cict_portal.sql. Manipulation leads to cleartext storage of sensitive information. The attack can be launched remotely and the exploit is publicly available.

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject. The vulnerability affects the Windows platform.

OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps.

OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects.

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation.

OpenVPN versions 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries.

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the user running Ant in versions prior to Ant 1.10.18.

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.

The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths.

When using the Direct XIP update strategy, the main application image starts other cores (e.g., radio core) based on the currently active slot without additional verification. MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation where MCUboot picks different slots for different images, resulting in booting the main application from one slot and starting the radio image from an unauthenticated slot.

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 involving an unknown function of the file auth_process.php in the Login component. This manipulation causes session fixation. The attack can be initiated remotely and the exploit is publicly disclosed.

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 involving an unknown function of the file manage_subjects.php. Manipulation of the arguments msg/title/content results in cross site scripting. The attack may be performed remotely and the exploit is public.