CVE Vulnerability Catalog

code-projects Simple Laundry System 1.0 has a cross-site scripting vulnerability in /delmemberinfo.php via the userid argument. The attack can be initiated remotely. The exploit is public and may be used.

itsourcecode Construction Management System 1.0 has SQL Injection in /borrowed_tool_report.php via the Home argument. Remote attack possible, exploit public.

A business logic error has been discovered in SourceCodester Pharmacy Product Management System 1.0 in the file add-sales.php, within the POST Parameter Handler component. Manipulating the txtqty argument leads to business logic errors. The attack can be performed remotely and the exploit has been publicly released.

A vulnerability exists in SourceCodester Online Food Ordering System 1.0 in the save_product function of /Actions.php in the POST Parameter Handler component. Manipulation of the price argument leads to business logic errors. The attack may be performed remotely. The exploit is publicly available and might be used.

GitLab EE versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 have a vulnerability in customizable analytics dashboards allowing an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

A vulnerability was found in GitLab EE due to incorrect authorization, which under certain circumstances allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects.

GitLab CE/EE from versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 contains a vulnerability that allows an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

GitLab EE from versions 11.3 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 contains a vulnerability that allows an authenticated user with developer role to modify protected environment settings due to improper authorization checks in the API.

In GitLab EE (versions 18.0.0-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can leak IP addresses of users viewing Code Quality reports via specially crafted content.

In GitLab EE (versions 18.2-18.8.9, 18.9-18.9.5, 18.10-18.10.3), an authenticated user can cause a denial of service to the entire GitLab instance due to improper input validation in GraphQL queries.

In GitLab EE versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an issue exists that under certain circumstances could allow an authenticated user to access other users' email addresses via GraphQL queries.

Google Chrome prior to 147.0.7727.55 has insufficient validation in WebSockets, allowing an attacker with compromised renderer to bypass same-origin policy via crafted HTML.

Google Chrome prior to 147.0.7727.55 has an inappropriate implementation in Navigation, allowing a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page. (Severity: Low)

Google Chrome prior to version 147.0.7727.55 contains a policy bypass vulnerability in ServiceWorkers that allows a remote attacker to bypass Content Security Policy via a crafted HTML page. (Severity: Low)

Google Chrome on Android prior to 147.0.7727.55 has an incorrect security UI in Omnibox, allowing a remote attacker to spoof the URL bar contents via a crafted HTML page. (Severity: Low)

Google Chrome on Windows prior to 147.0.7727.55 has incorrect security UI in permissions, allowing domain spoofing via crafted HTML.

Google Chrome prior to version 147.0.7727.55 has a policy bypass vulnerability in IFrameSandbox. A remote attacker can convince a user to perform specific UI gestures to bypass navigation restrictions via a crafted HTML page.

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)

Google Chrome prior to 147.0.7727.55 has a policy bypass in Downloads, allowing a remote attacker to bypass multi-download protections via a crafted HTML page. (Severity: Low)