CVE Vulnerability Catalog

CVE-2023-37560 describes a cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier, allowing a remote unauthenticated attacker to inject arbitrary scripts.

Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

In the incfs_kill_sb function in fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege requiring System execution privileges.

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive.

A critical vulnerability was found in SourceCodester Service Provider Management System version 1.0. Manipulation of the 'id' argument in the file /classes/Master.php?f=save_inquiry leads to SQL injection, which can be initiated remotely.

A vulnerability was found in GZ Scripts Vacation Rental Website 1.8, affecting some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ in the HTTP POST Request Handler component. Manipulation of the arguments username/title/comment leads to cross-site scripting.

A vulnerability has been found in NodCMS 3.4.1 affecting an unknown functionality of the file /en/blog-comment-4 in the POST Request Handler component. Manipulation of the arguments comment_name/comment_content leads to cross site scripting.

A vulnerability exists in Palo Alto Networks PAN-OS software that allows an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

Online Piggery Management System version 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to 'manage-breed.php', resulting in Persistent XSS.

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

The MathWorks Polyspace Plugin for Jenkins version 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.

A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

The Jenkins Test Results Aggregator Plugin version 1.2.13 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

The Rebuilder plugin in Jenkins version 320.v5a_0933a_e7d61 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to rebuild a previous build.

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

The mabl plugin in Jenkins versions 0.0.46 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using credentials obtained through another method.

The mabl plugin for Jenkins version 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access credentials they are not entitled to.

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins OpenShift Login Plugin version 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines whether a redirect URL after login legitimately points to Jenkins, allowing attackers to perform phishing attacks.