CVE Vulnerability Catalog

Improper authorization of an index containing sensitive information exists in the GitHub repository omeka/omeka-s prior to version 4.0.4.

A critical vulnerability has been found in Bettershop LaikeTui, allowing unrestricted file uploads through manipulation of functionality in the file index.php?module=api&action=user&m=upload. The attack can be launched remotely.

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.

A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.

IBM Storage Copy Data Management versions 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

A critical vulnerability was found in the Online Graduate Tracer System 1.0, affecting the mysqli_query function in the sexit.php file. Manipulation of the id argument leads to SQL injection, which can be launched remotely.

A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.

A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3 in an unknown function of the /search file handling the GET parameter. Manipulation of the filter[brandid] argument leads to SQL injection. The attack may be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230816, concerning an unknown functionality of the file /sysmanage/licence.php. Manipulation of this functionality leads to improper access controls.

A critical vulnerability was found in IBOS OA version 4.5.5, allowing SQL injection through manipulation of the file ?r=recruit/bgchecks/export&checkids=x.

A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230809, rated as problematic. The issue affects some unknown processing of the file /config/php.ini, leading to direct requests.

A vulnerability in Microsoft Edge (Chromium-based) allows for elevation of privilege, potentially leading to unauthorized access to the system.

A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=recruit/contact/export&contactids=x. Manipulation of this code leads to SQL injection.

A critical vulnerability was found in D-Link DAR-8000-10 up to version 20230809, affecting the file /app/sys1.php. Manipulation of the cmd argument with input id leads to remote OS command injection.

Array AG OS versions before 9.4.0.499 allow denial of service, where remote attackers can cause system service processes to crash through abnormal HTTP operations.

A vulnerability in the Connect Mobility Router component of MiVoice Connect through version 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration.

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.