CVE Vulnerability Catalog

W systemie zarządzania studentami itsourcecode w wersji 1.0 odkryto podatność, która dotyczy nieznanej funkcjonalności pliku /promote.php. Manipulacja argumentem sy prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie zarządzania studentami itsourcecode w wersji 1.0 odkryto podatność, która dotyczy nieznanej funkcjonalności pliku /new_school_year.php. Manipulacja argumentem sy prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie zarządzania studentami itsourcecode w wersji 1.0 znaleziono lukę. Nieznana funkcja w pliku /new_adviser.php pozwala na manipulację argumentem Name, co może prowadzić do wstrzyknięcia SQL. Atak może być przeprowadzony zdalnie.

OpenSIS version 9.2 and below is vulnerable to Incorrect Access Control in Student.php, allowing an authenticated low-privilege user to perform unauthorized database write operations on other users' data.

A flaw in the user interface of Microsoft Exchange Server leads to misrepresentation of critical information, allowing an unauthorized attacker to perform spoofing over a network.

Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

A race condition in Windows Shell allows an authorized attacker to elevate privileges locally. The issue stems from improper synchronization when using a shared resource concurrently.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

A use of password hash instead of password for authentication vulnerability [CWE-836] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests.

FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11 rely on cookies without validation and integrity checking. An unauthenticated attacker may execute arbitrary operations on the system via crafted HTTP or HTTPS requests using forged cookies, requiring prior knowledge of the FortiWeb serial number.

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.

A use after free vulnerability in Microsoft Office allows an unauthorized attacker to execute code locally.

A use-after-free vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally.

A vulnerability in Microsoft Office related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.

A relative path traversal vulnerability in Microsoft Office Access allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

A vulnerability in Windows Remote Access Connection Manager is due to improper access control. An authorized attacker can elevate privileges locally.

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. The vulnerability could lead to data leakage.

Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

A heap-based buffer overflow in the Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.