CVE Vulnerability Catalog

Server Side Request Forgery (SSRF) vulnerability in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL. The flaw stems from insufficient filtering of outgoing server requests.

Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.

A vulnerability in Microsoft Edge (Chromium-based) allows for elevation of privilege. An attacker can exploit this flaw to gain higher privileges on the system.

A vulnerability in Microsoft Edge for Android allows spoofing, which may lead to user data theft. An attacker can exploit this flaw to impersonate trusted sources.

A vulnerability in Microsoft Edge (Chromium-based) allows for spoofing, which may lead to unauthorized access to user data.

A sensitive information leak issue has been discovered in GitLab EE affecting all versions from 16.0 to 16.0.6 and from 16.1 to 16.1.1. It allows access to titles of private issues and MRs.

WebBoss.io CMS before version 3.7.0.1 contains a reflected XSS vulnerability.

A Cross-site Scripting (XSS) vulnerability - Reflected exists in the GitHub repository pimcore/pimcore prior to version 10.6.4.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository pimcore/pimcore prior to version 10.6.4, allowing for the storage of malicious code.

There is an SQL Injection vulnerability in the GitHub repository pimcore/pimcore prior to version 10.6.4.

In the GitHub repository pimcore/pimcore prior to version 10.6.4, there is a vulnerability that allows the exposure of sensitive information to unauthorized actors.

Metabase versions before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server at the server's privilege level. Exploitation does not require authentication.

An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.

A format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U. This issue is caused by lacking validation for a specific value when calling the cm_processChangedConfigMsg function in the AiMesh system.

A format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U. This issue is caused by directly using input as a format string when calling syslog in the logmessage_normal function of the do_detwan_cgi module.

A vulnerability has been found in y_project RuoYi up to version 4.7.7, affecting the uploadFilesPath function of the File Upload component. Manipulation of the originalFilenames argument leads to cross site scripting.

A critical vulnerability was found in Hospital Management System version 1.0. The issue affects some unknown processing of the file patientprofile.php, where manipulation of the argument address leads to SQL injection.

CVE-2023-37292 describes an improper neutralization of special elements used in OS commands, allowing OS command injection in iSherlock 4.5 and 5.5 user modules. This issue affects iSherlock 4.5 before iSherlock-user-4.5-174 and iSherlock 5.5 before iSherlock-user-5.5-174.

A critical vulnerability was found in Hospital Management System version 1.0, affecting unknown code in the file patientappointment.php. Manipulation of the arguments loginid, password, mobileno, appointmentdate, appointmenttime, patiente, dob, doct, and city leads to SQL injection.

A critical vulnerability was found in Hospital Management System version 1.0. Manipulation of the 'address' argument in the patient.php file leads to SQL injection, which can be executed remotely.