CVE Vulnerability Catalog

User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.

There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.

In PHPJabbers Car Rental Script version 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.

There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Make an Offer Widget v1.0.

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the 'action' parameter of index.php.

There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Yacht Listing Script v1.0.

PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the 'column' parameter of index.php.

PHPJabbers Food Delivery Script version 3.0 has a SQL injection (SQLi) vulnerability in the 'q' parameter of index.php.

An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920 related to improper handling of PPP length parameter inconsistency, which can cause an infinite loop.

Sliver from versions 1.5.x to 1.5.39 has an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses.

CVE-2023-40195 involves deserialization of untrusted data in the Apache Airflow Spark Provider, allowing authorized users to execute arbitrary code on the Airflow node by pointing to a malicious Spark server.

Saho's attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.

Saho's attendance devices ADM100 and ADM-100FP have insufficient filtering for special characters and file types within their file uploading function. This allows an unauthenticated remote attacker to upload and execute arbitrary files, potentially performing arbitrary system commands or disrupting service.

Saho's attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data.

SpotCam Sense has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary system commands or disrupt service.

SpotCam FHD 2 by SpotCam Co., Ltd. has a vulnerability related to the use of hard-coded uBoot credentials. A remote attacker can exploit this vulnerability to gain access to the system to perform arbitrary system operations or disrupt service.

The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to perform command injection attacks or disrupt service.

The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that contains a vulnerability due to hard-coded Telnet credentials. A remote unauthenticated attacker can exploit this vulnerability to gain access to the system and perform arbitrary system operations or disrupt services.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.4, allowing for the storage of malicious code.