CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to inject arbitrary web scripts or HTML via a crafted payload in /edit-db.php.

The vulnerability in the httpx library before version 0.23.0 is caused by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. This can lead to unexpected behavior or potential attacks.

CuppaCMS v1.0 contains a SQL injection vulnerability in the file /administrator/alerts/alertLightbox.php. An attacker can exploit this flaw to execute unauthorized database queries.

CuppaCMS v1.0 contains a SQL injection vulnerability in the menu_filter parameter at /administrator/templates/default/html/windows/right.php. An attacker can exploit this flaw to manipulate database queries.

Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

Cross-site scripting (XSS) vulnerability in the Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8. Remote attackers can inject arbitrary web script or HTML via web content template names.

SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at booking.php.

SCBS Online Sports Venue Reservation System v1.0 was found to have a local file inclusion (LFI) vulnerability. This allows an attacker to execute arbitrary code via a crafted PHP file.

The VeryFitPro app (com.veryfit2hr.second) version 3.2.8 hashes the account password locally on the device and uses the hash for authentication in all communication with the backend API, including login, registration, and password changes. This allows an attacker in possession of the hash to take over a user's account, rendering the benefits of storing hashed passwords in the database useless.

W systemie Lenovo System Update zgłoszono podatność, która może umożliwić lokalnemu użytkownikowi z interaktywnym dostępem do systemu wykonanie kodu z podwyższonymi uprawnieniami podczas instalacji pakietu aktualizacji systemu wydanego przed 25 lutego 2022 roku, który wyświetla okno wiersza poleceń.

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

A segmentation violation was discovered in the FreeType library in the FT_Request_Size function, potentially causing program crashes.

A segmentation violation was discovered in the FreeType library in the FNT_Size_Request function, potentially causing program crashes.

A vulnerability in the Datagram TLS (DTLS) protocol implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization, resulting in a denial of service (DoS) condition. This is due to suboptimal processing when establishing a DTLS tunnel as part of an AnyConnect SSL VPN connection. An attacker could exploit this by sending a steady stream of crafted DTLS traffic, exhausting resources on the device.

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This issue is due to the presence of a static SSH host key.