CVE Vulnerability Catalog

Zidentyfikowano podatność w systemie zarządzania kurierskiego Courier Management System w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /courier/edit-courier.php, gdzie manipulacja argumentem OfficeName prowadzi do wstrzykiwania SQL.

Pi-hole Admin Interface before version 6.3 is vulnerable to CRLF injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without proper input sanitization. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both headers and content of the HTTP response, enabling injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and weakening or bypassing browser-based security mechanisms such as CSP or X-XSS-Protection.

Constellation, the first Confidential Kubernetes, uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passphrase. Due to unsafe handling of null keyslot algorithms in cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to 2.8.1 does not report an error when processing LUKS2-formatted disks using the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

A vulnerability was determined in code-projects Food Ordering System 1.0. An unknown function of the file /admin/menu.php is affected. Manipulation of the itemPrice argument can lead to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of view-pass-detail.php. Manipulation of the Fullname/Category arguments causes cross site scripting. The attack may be initiated remotely and the exploit has been published.

A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of edit-category-detail.php. Manipulation of the catname argument results in cross site scripting. The attack can be launched remotely and the exploit is now public.

Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping.

Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering its intended functionality.

IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 are vulnerable to privilege escalation due to improper privilege assignment to an update script.

Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript that executes when another user navigates to the Tools section and performs a gravity database update. The vulnerability is patched in version 6.3.

Zidentyfikowano słabość w projekcie kodu Nero Social Networking Site w wersji 1.0, która dotyczy nieznanej części pliku /friendprofile.php. Manipulacja argumentem ID może prowadzić do wstrzyknięcia SQL.

W kodzie projektu Nero Social Networking Site 1.0 odkryto lukę bezpieczeństwa. Problem dotyczy nieznanej funkcjonalności pliku /deletemessage.php, gdzie manipulacja argumentem message_id prowadzi do wstrzykiwania SQL.

Zidentyfikowano podatność w projekcie kodu Nero Social Networking Site w wersji 1.0. Wykorzystanie nieznanej funkcji w pliku /addfriend.php prowadzi do wstrzykiwania SQL, co może być przeprowadzone zdalnie.

W kodzie projektu Nero Social Networking Site w wersji 1.0 zidentyfikowano podatność. Manipulacja argumentem ID w pliku /acceptoffres.php prowadzi do wstrzykiwania SQL, co może być wykorzystane zdalnie.

A deserialization vulnerability was found in quequnlong shiyi-blog up to 1.2.1, affecting an unknown function in SysJobController.java (Job Handler component). The attack can be executed remotely and a public exploit is available.

A vulnerability in TIME-SEA-PLUS up to version fb299162f18498dd9cf17da906886d80a077d53b. The alipayIsSucceed function in PayController.java of the Order Status Handler component does not properly enforce authorization, allowing unauthorized actions. The attack can be performed remotely, and exploit details are publicly disclosed.