CVE Vulnerability Catalog

In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.

In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.

xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions.

There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository bookstackapp/bookstack prior to version 23.08. This allows attackers to send requests to internal server services, potentially leading to the exposure of sensitive information.

A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.

A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230816, concerning an unknown functionality of the file /sysmanage/licence.php. Manipulation of this functionality leads to improper access controls.

A vulnerability was found in the NeoMind Fusion Platform up to version 20230731, allowing cross site scripting (XSS) attacks through manipulation of the link argument in the /fusion/portal/action/Link file. The attack can be executed remotely.

In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during user registration.

In the password recovery form of Silverware Games, the response time varies depending on whether the specified email address exists in the database. This issue has been fixed in version 1.3.7.

An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors.

A vulnerability has been reported affecting QNAP operating systems regarding the cleartext transmission of sensitive information. If exploited, local network clients may read unexpected sensitive data via unspecified vectors.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.

IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 is vulnerable to information disclosure of script content if the remote REST request policy is enabled.

In curl 7.65.2, an integer overflow occurs in tool_operate.c with a large retry delay value.

A vulnerability in Microsoft Edge (Chromium-based) allows for information disclosure. An attacker could exploit this flaw to gain access to sensitive user data.

A CSRF vulnerability in Chamilo versions 1.11 through 1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code. The flaw is due to missing cross-site request forgery protections.

A vulnerability was found in Control iD Gerencia Web 1.30, affecting an unknown functionality of the Cookie Handler component. Manipulation leads to cleartext storage of sensitive information.

A vulnerability has been found in MaximaTech Portal Executivo version 21.9.1.140, affecting unknown code of the Cookie Handler component. The manipulation leads to missing encryption of sensitive data.

A vulnerability classified as problematic has been found in tdevs Hyip Rio 2.1. It affects some unknown functionality of the file /user/settings of the Profile Settings component, where manipulation of the avatar argument leads to cross site scripting.