CVE Vulnerability Catalog

A critical vulnerability has been found in Bylancer QuickOrder 6.3.7, affecting some unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Bylancer QuickQR version 6.3.7, affecting an unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability has been found in Bylancer QuickJob 6.1, affecting an unknown function of the GET Parameter Handler component. Manipulation of the keywords/gender argument leads to SQL injection.

A critical vulnerability was found in Bylancer QuickVCard 2.1, affecting unknown processing of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Bylancer QuickAI OpenAI 3.8.1, affecting unknown code in the /blog file of the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Nesote Inout Blockchain EasyPayments 1.0, affecting an unknown function of the file /index.php/payment/getcoinaddress. Manipulation of the argument coinid leads to SQL injection.

A critical vulnerability has been found in the Lost and Found Information System version 1.0, affecting an unknown part of the file /classes/Master.php?f=save_item. Manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in SourceCodester Lost and Found Information System version 1.0. The issue affects an unknown functionality of the file /classes/Master.php?f=save_inquiry, where manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in AC Repair and Services System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=delete_inquiry leads to SQL injection.

PNP4Nagios version 0.6.26 has a stored XSS vulnerability in the AJAX controller via the basket API and filters.

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. An attacker may authenticate as another user when logging in as a user with SSO enabled, and any user account without a second factor enabled could be compromised.

Discourse is an open source discussion platform with a vulnerability that can cause a denial of service when attempting to create or update a custom sidebar section. This issue has been patched in commit `52b003d915`.

An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management (CFM) module of Juniper Networks Junos OS allows an adjacent attacker on the local broadcast domain to cause a Denial of Service (DoS) by sending malformed CFM packets.

An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.

The Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13, fixed in v.6.12.0.6 and v.6.13.0, allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.

A tampering vulnerability has been identified in Microsoft Edge for Android (Chromium-based) that could allow an attacker to make unauthorized changes to the application.

A vulnerability in Microsoft Edge for iOS allows spoofing, which may lead to information theft from users.

CVE-2023-36849 describes an improper check or handling of exceptional conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS. This allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS) by sending malformed LLDP packets.