CVE Vulnerability Catalog

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.

In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context.

In multiple Codesys products in multiple versions, after successful authentication as a user, specifically crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.

A critical vulnerability was found in the Byzoro Smart S85F Management Platform up to version 20230722. Manipulation of the argument file_upload leads to unrestricted file uploads, allowing for remote attacks.

A critical vulnerability was found in the Byzoro Smart S85F Management Platform up to version 20230722. The issue affects some unknown processing of the file importhtml.php, where manipulation of the sql argument leads to command injection.

A vulnerability has been found in Academy LMS 6.0 that leads to cross site scripting attacks. The issue affects unknown code in the file /academy/home/courses, and manipulation of the argument query/sort_by allows for remote attacks.

A vulnerability was found in Cute Http File Server 2.0, classified as problematic. It affects an unknown part of the search component and leads to cross site scripting attacks.

A vulnerability has been found in PHP Jabbers Rental Property Booking 2.0 that allows cross site scripting attacks through manipulation of the index argument in the /index.php file. The attack can be launched remotely.

A vulnerability was found in PHP Jabbers Taxi Booking 2.0 that allows cross site scripting (XSS) attacks through manipulation of the index argument in the /index.php file. The attack can be launched remotely.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.

A vulnerability in PHP Jabbers Cleaning Business 1.0 allows for cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0, rated as problematic. This issue affects some unknown processing of the file /index.php, leading to cross-site scripting attacks.

A use after free vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

CVE-2023-38747 describes a heap-based buffer overflow vulnerability in CX-Programmer included in CX-One CXONE-AL[][]D-V4 version 9.80 and earlier. Opening a specially crafted CXP file by a user may lead to information disclosure and/or arbitrary code execution.

A vulnerability was found in PHP Jabbers Service Booking Script version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the index argument in the /index.php file.

A vulnerability was found in PHP Jabbers Shuttle Booking Software version 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the /index.php file. The attack can be initiated remotely.

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

CVE-2023-3346 in MITSUBSHI CNC Series has a buffer overflow vulnerability that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition and execute arbitrary code on the device by sending specially crafted packets. A system reset is also required for recovery.