CVE Vulnerability Catalog

The ShopConstruct plugin versions up to 1.1.2 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the user's browser context.

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.

An issue has been discovered in GitLab CE/EE affecting all versions from 11.8 to 16.1.5, from 16.2 to 16.2.5, and from 16.3 to 16.3.1. A malicious Maintainer can, under specific circumstances, leak the Sentry token by changing the configured URL in the Sentry error tracking settings page.

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation, it was possible to create model experiments in public projects.

Senayan Library Management Systems SLIMS version 9.6.1 is vulnerable to SQL Injection via loan_rules.php in the admin module.

Senayan Library Management Systems SLIMS 9 Bulian version 9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.

Certain Lexmark devices (such as CS310) before August 25, 2023, are vulnerable to XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246 or higher to remediate the vulnerability.

An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured.

An issue has been discovered in GitLab EE affecting all versions from 16.1 to 16.1.5, from 16.2 to 16.2.5, and from 16.3 to 16.3.1. An external user with an owner role in a group may escalate their privileges by creating a service account in that group.

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.

In versions of tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.

Improper input validation exists in the GitHub repository usememos/memos prior to version 0.13.2.

Improper Privilege Management exists in the GitHub repository usememos/memos prior to version 0.13.2.

Improper access control exists in the GitHub repository usememos/memos prior to version 0.13.2.

A predictable algorithm was used in the random number generator in the GitHub repository pkp/pkp-lib prior to version 3.3.0-16.

An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). Receiving specially crafted BGP UPDATE messages may lead to the teardown of a BGP session or affect other remote systems.

Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.