CVE Vulnerability Catalog

Podatność związana z nieprawidłowymi domyślnymi uprawnieniami w Centreon Infra Monitoring (moduły MBI) pozwala na osadzanie skryptów w skryptach przez konto użytkownika CentreonBI na serwerze MBI. Problem ten dotyczy wersji Infra Monitoring: od 24.10.0 do przed 24.10.6, od 24.04.0 do przed 24.04.9, od 23.10.0 do przed 23.10.15.

A Denial of Service (DoS) vulnerability exists in the ZTE MC889A Pro product. Due to insufficient validation of input parameters in the Short Message Service interface, an attacker can exploit it to perform a DoS attack.

A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.

A stack-based buffer overflow vulnerability was found in TOTOLINK A3300R in the setSyslogCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the enable argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in TOTOLINK A3300R in the setScheduleCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the recHour argument. The attack can be initiated remotely, and the exploit has been published.

A stack-based buffer overflow vulnerability was detected in TOTOLINK A3300R in the setOpModeCfg function of /cgi-bin/cstecgi.cg, caused by manipulation of the opmode argument. The attack may be performed remotely.

W systemie SourceCodester Online Student Result System w wersji 1.0 wykryto podatność bezpieczeństwa. Problem dotyczy nieznanego przetwarzania pliku /view_result.php, gdzie manipulacja argumentem ID prowadzi do wstrzyknięcia SQL.

The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.

W produkcie ZTE ZXMP M721 występuje podatność na ujawnienie klucza prywatnego. Użytkownik o niskich uprawnieniach może obejść kontrole autoryzacji, aby zobaczyć klucz prywatny komunikacji urządzenia, co prowadzi do jego ujawnienia i wpływa na bezpieczeństwo komunikacji.

A security flaw has been discovered in code-projects Online Event Judging System 1.0. The file /add_contestant.php is affected. Manipulation of the argument fullname results in SQL injection. Remote exploitation is possible, and the exploit is public.

A vulnerability was identified in code-projects Online Event Judging System 1.0. The file /add_judge.php is affected. Manipulation of the argument fullname leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available.

W systemie operacyjnym AMTT Hotel Broadband w wersji 1.0 zidentyfikowano podatność, która dotyczy nieznanej funkcjonalności pliku /user/portal/get_expiredtime.php. Manipulacja argumentem uid prowadzi do wstrzyknięcia SQL, co może być zrealizowane zdalnie.

A vulnerability was found in code-projects Online Event Judging System 1.0. The file /ajax/action.php is affected. Manipulation of the argument content results in SQL injection. The attack can be launched remotely, and the exploit has been made public.

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents using the sms:, smsto:, mms:, and mmsto: URI schemes is incorrectly implemented. An attacker capable of invoking an Android intent can send messages on the user's behalf without further interaction or permissions.

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Wykryto podatność bezpieczeństwa w CLTPHP 3.0, która dotyczy nieznanej funkcji w pliku /home/search.html. Manipulacja argumentem 'keyword' prowadzi do wstrzykiwania SQL.

Zidentyfikowano słabość w Hasleo Backup Suite do wersji 5.2, dotyczącą nieznanej funkcji komponentu HasleoImageMountService/HasleoBackupSuiteService. Manipulacja ta prowadzi do niecytowanej ścieżki wyszukiwania.

A cross-site scripting (XSS) vulnerability was found in Simple E-Banking System 1.0 in the file /eBank/register.php. Manipulation of the Username argument allows injection of malicious script. The attack can be launched remotely and the exploit has been publicly disclosed.

A stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform is caused by improper sanitization of uploaded SVG files. An authenticated attacker can upload a malicious SVG file containing a script payload to a campaign, which executes in another user's browser when they view the image on the public LMT microsite. This can lead to session hijacking, data theft, or other unauthorized actions. The issue affects versions before 4.617.4.

A vulnerability was found in code-projects Client Details System 1.0. The file clientdetails/welcome.php in the GET Parameter Handler component is affected. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been made public.