CVE Vulnerability Catalog

A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.

In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.

A flaw was found in GLib related to GVariant deserialization. A crafted GVariant can cause excessive processing, leading to denial of service.

There is a failure in the -fstack-protector feature in GCC-based toolchains targeting AArch64, allowing an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without detection. This issue only affects C99-style dynamically-sized local variables or those created using alloca().

Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.

A SQL injection vulnerability in the Search functionality of tickets.php page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.

A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.

In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.

In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.

In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.

In vowifiservice, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.

A critical vulnerability was found in DedeCMS version 5.7.110, affecting unknown code in the file /uploads/tags.php. Manipulation of the argument tag_alias leads to SQL injection.

A critical vulnerability was found in the Byzoro Smart S45F Multi-Service Secure Gateway management platform up to version 20230822. The issue affects an unknown functionality of the file /importexport.php, leading to SQL injection.

A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown processing of the file ?r=dashboard/user/export&uid=X. Manipulation of this file leads to SQL injection.

A critical vulnerability has been found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=diary/default/del of the Delete Logs Handler component. Manipulation of this vulnerability leads to SQL injection.

A critical vulnerability was found in IBOS OA 4.5.5, affecting an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the Delete Draft Handler component. The manipulation leads to SQL injection.

A critical vulnerability has been found in the Byzoro Smart S85F Management Platform up to version 20230820. The issue affects an unknown functionality of the file /sysmanage/updateos.php, allowing unrestricted file uploads through manipulation of the argument 1_file_upload.

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotiation. The Disable Peer Verification property was effectively flipped, disabling verification by default when using HTTPS.