CVE Vulnerability Catalog

In Veritas NetBackup Appliance before version 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.

Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.

An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.

A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

A flaw was found in the MCTP protocol in the Linux kernel that may lead to use-after-free vulnerabilities. The mctp_unregister() function reclaims the device's resources when a netcard detaches, which can cause issues if a running routine is unaware of this.

A NULL pointer dereference flaw exists in the Linux kernel's submit_lookup_cmds function due to a lack of check on the return value of kmalloc(). This issue allows a local user to crash the system.

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.

PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.

PHPgurukl Small CRM version 1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code in the context of the user's browser.

An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. The vulnerability may allow an attacker to inject malicious script.

A critical vulnerability was found in the Ruijie RG-BCR860 device version 2.5.13, affecting unknown processing of the Network Diagnostic Page component. Manipulation leads to OS command injection.

A critical vulnerability has been found in IBOS OA 4.5.5 affecting the actionExport function of the file ?r=recruit/interview/export&interviews=x of the Interview Management Export component. Manipulation of the interviews argument leads to SQL injection.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository spinacms/spina prior to version 2.15.1, allowing for the storage of malicious code.

Reflected XSS vulnerability affects the 'mode' parameter in the /admin functionality of the web application in versions <=2.0.44.

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 10.40. This is due to missing or incorrect nonce validation when sending test emails.

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function, allowing unauthenticated attackers to change the admin role to customer or modify user meta via a forged request.