CVE Vulnerability Catalog

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.

Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['page'] parameter. An attacker can inject malicious script.

Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['s'] parameter. An attacker can inject malicious script.

A stored XSS vulnerability was found in the Add New Employee form of Sourcecodester Employee Daily Task Management System 1.0. A remote attacker can inject and store arbitrary JavaScript code via the Name field, which executes when the data is viewed.

A directory traversal vulnerability in Bookeen Notea Firmware BK_R_1.0.5_20210608 allows an attacker to obtain sensitive information by manipulating file paths.

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses AAD data as the MAC key, making the MAC key trivially predictable. An attacker performing a man-in-the-middle attack could modify data sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data still passes the MAC integrity check. This affects OpenSSL 3.0.0–3.0.2 and is fixed in 3.0.3.

The OCSP_basic_verify function in OpenSSL can return a positive result (successful verification) even when the OCSP response signing certificate fails to verify, if the OCSP_NOCHECKS flag is used. The issue also affects the command line "ocsp" application with the "-no_cert_checks" option, which reports success despite an actual verification failure. Fixed in OpenSSL 3.0.3 (affected 3.0.0, 3.0.1, 3.0.2).

A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient error handling. An attacker could send a crafted file through the device, causing the analysis process to crash and resulting in DoS. Manual intervention may be required.

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This is due to incorrect feed update processing. An attacker could send traffic through an affected device that should be blocked, to bypass device controls and send traffic to protected systems.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This is due to insufficient input validation. Successful exploitation could result in unexpected processing of commands and unexpected output.

In libxml2 before 2.9.14, buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) do not check for integer overflows, which can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, such as libxslt through 1.1.35, is also affected.

Cyclos 4 PRO version 4.14.7 and earlier does not validate user input in error messages, allowing a remote unauthenticated attacker to execute JavaScript code via an undefined enum constant.

A DOM-based Cross-site Scripting (XSS) vulnerability in the account registration process in Cyclos 4 PRO version 14.7 and earlier. A remote attacker can inject arbitrary web script or HTML via the groupId parameter.

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. This can lead to kernel memory corruption.

A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to inject arbitrary web scripts or HTML via a crafted payload in /edit-db.php.