CVE Vulnerability Catalog

Apache Tomcat has an improper resource shutdown or release vulnerability. If an error occurs during multipart upload processing, temporary copies of uploaded parts are not cleaned up immediately but left for garbage collection, potentially leading to disk space exhaustion and DoS.

Podatność SQL injection w tlocke pg8000 w wersji 1.31.4 umożliwia zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez specjalnie przygotowany input w postaci listy Pythona do funkcji pg8000.native.literal.

Apache Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system that supported ANSI escape sequences, an attacker could use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker-controlled command.

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before decoding, allowing an attacker to manipulate the request URI to bypass security constraints including /WEB-INF/ and /META-INF/ protection. If PUT requests are enabled, malicious files can be uploaded leading to remote code execution.

A vulnerability in PHPGurukul Curfew e-Pass Management System 1.0, affecting an unknown function in the file admin-profile.php. Manipulation of the adminname/email arguments leads to cross-site scripting (XSS). The attack may be launched remotely. The exploit has been published.

A cross-site scripting (XSS) vulnerability was detected in code-projects Simple Food Ordering System 1.0 in an unknown function of /editproduct.php. Manipulation of the pname/category/price arguments allows injection of malicious script. The attack can be launched remotely and the exploit is publicly available.

W systemie Simple Food Ordering System w wersji 1.0 wykryto podatność bezpieczeństwa, która dotyczy nieznanej funkcji w pliku /editproduct.php. Manipulacja argumentem photo prowadzi do nieograniczonego przesyłania plików.

A weakness has been identified in code-projects Simple Food Ordering System 1.0 affecting unknown processing of the file /addcategory.php. Manipulation of the cname argument causes cross site scripting. The attack can be initiated remotely and the exploit has been made available to the public.

A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument pname/category/price results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

A cross-site scripting (XSS) vulnerability was identified in code-projects Simple Food Ordering System 1.0 in an unknown part of /editcategory.php. Manipulation of the pname argument leads to injection of malicious script. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.

A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

A weakness has been identified in D-Link DAP-2695 2.00RC13, affecting the function sub_40C6B8 of the Firmware Update Handler component. Manipulation can lead to improper verification of cryptographic signature. The attack can be launched remotely but is highly complex and difficult to exploit.

System zakupów online indieka900 w wersji 1.0 jest podatny na atak typu SQL Injection w parametrze hasła w pliku login.php.

Wimi Teamwork before 7.38.17 has a CSRF vulnerability in its API. The API accepts any authenticated request with a 'csrf_token' field without validating its value, allowing an attacker to execute requests with victim's privileges.

A SQL injection vulnerability has been discovered in SourceCodester Point of Sales 1.0 in the /delete_category.php file. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be exploited.

Zidentyfikowano podatność w systemie Point of Sales 1.0 od SourceCodester, która dotyczy nieznanego przetwarzania pliku /category.php. Manipulacja argumentem Category prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie SourceCodester Point of Sales w wersji 1.0 zidentyfikowano podatność, która dotyczy nieznanego kodu w pliku /index.php. Manipulacja argumentem 'Username' prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.

AhnLab EPP version 1.0.15 is vulnerable to SQL injection via the 'preview' parameter. An attacker can exploit this flaw to manipulate database queries.