CVE Vulnerability Catalog

A vulnerability has been found in kishor-23 food-waste-management-system. This affects an unknown function of the file login.php of the Login Flow component. Manipulation of the PHPSESSID argument leads to session fixation, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used; the product does not use versioning, so affected release information is unavailable.

Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file admin/newsletters.php in the Newsletter Management component, where manipulation of the module argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

Code injection vulnerability in osCommerce2 up to 2.3.4.1. Affects the include function in the file includes/classes/payment.php in the Payment Page component, where manipulation of the MODULE_PAYMENT_INSTALLED argument leads to code injection. The attack can be executed remotely, and the exploit is public. The project has not responded.

SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file /admin/key.php, where manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit is public.

SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file /new.php, where manipulation of the schedid argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.

SQL injection vulnerability in itsourcecode Online Admission System 1.0. Affects the file register1.php, where manipulation of the fname argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.

In the venc component, there is a possible out-of-bounds write due to type confusion. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the mtee component, there is a possible privilege escalation due to a missing bounds check. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the mtee component, there is a possible privilege escalation due to type confusion. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the vdec component, there is a possible out-of-bounds write due to type confusion. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the meta component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Modem component, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In the apusys component, there is a possible memory corruption due to use after free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the Modem component, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Modem component, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Modem module, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.

In the Modem module, there is a possible out-of-bounds read due to a missing permission check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not required for exploitation.

In the aidl module, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.

In the aidl module, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.

In the aidl module, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not required for exploitation.