CVE Vulnerability Catalog

The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to transmitting write requests and characters, which may allow an attacker to manipulate device data or functions.

In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

A Cross Site Scripting (XSS) vulnerability was found in Chikista Patient Management Software 2.0.2 in the first_name parameter. It affects the following pages: patient/insert, patient_report, appointment_report, visit_report, and bill_detail_report.

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.

In Totolink A3100R firmware version V5.9c.4577, the test.asp file exposes an unauthenticated API-like function. This allows an attacker to modify multiple device settings without any authentication.

A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to inject malicious scripts or HTML via the 'special' field.

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. The flaw can lead to stack exhaustion when processing crafted input.

CheckMK Raw Edition versions 1.5.0 to 1.6.0 do not sanitize input of a web service parameter in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor with HTML content interpreted by the browser (e.g., JavaScript) or steal session cookies of an authenticated user via man-in-the-middle.

Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table. An attacker can inject a malicious script that will be executed in the victim's browser.

The vulnerability in SurveyKing v0.2.0 retains users' session cookies after logout. An attacker can use the browser cache to log in to the system and access data when the user exits the application.

Yonyou u8 v13.0 was found to contain a DOM-based cross-site scripting (XSS) vulnerability via the /u8sl/WebHelp component. An attacker can inject a malicious script that executes in the victim's browser.

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.

A cross-site scripting (XSS) vulnerability was discovered in BigAnt Server version 5.6.06. It allows an attacker to inject malicious scripts into web pages.

BigAnt Server version 5.6.06 uses weak password hashing functions, making password recovery easier.

An issue was discovered in MISP before version 2.4.156 related to the SVG org logo, which does not forbid the use of JavaScript by default.

An issue was discovered in MISP before version 2.4.156, allowing a malicious site administrator to store an XSS payload in the custom auth name. This payload would be executed each time the administrator modifies a user.

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches, and then cache allocation can allow the attacker to obtain sensitive information.

In the Linux kernel before version 5.16.3, drivers/bluetooth/virtio_bt.c has a memory leak (socket buffers have memory allocated but not freed).

SmartBear CodeCollaborator version 6.1.6102 contains a vulnerability in the web UI that allows a clickjacking attack. An attacker can trick a user into clicking a seemingly harmless element, performing unauthorized actions.