CVE Vulnerability Catalog

A Cross Site Scripting vulnerability in the Faculty Evaluation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.

A cross-site scripting (XSS) vulnerability was discovered in PHPJabbers Catering System v1.0 via the component /index.php?controller=pjAdmin&action=pjActionForgot.

There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.

There is a Cross Site Scripting (XSS) vulnerability in the 'cid' parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. An attacker can exploit this vulnerability to inject malicious JavaScript code.

An integer overflow flaw was found in pl_glyph_name in Ghostscript, which may allow a local attacker to cause a denial of service by transforming a crafted PCL file to PDF format.

A buffer overflow flaw was found in the devn_pcx_write_rle() function in Ghostscript, which may allow a local attacker to cause a denial of service by outputting a crafted PDF file for a DEVN device.

Barebones CMS version 2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.

A vulnerability in Firefox allows appref-ms files to be opened without warning the user that they may contain malicious code. This affects Firefox versions below 116 and Thunderbird versions below 102.14 and 115.1 on Windows.

The vulnerability allows a website to obscure the full screen notification by using a URL handled by an external program, which may lead to user confusion and potential spoofing attacks.

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account.

Race conditions in reference counting code were found, which could lead to potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.

CVE-2023-4045 concerns improper tracking of cross-origin tainting in Offscreen Canvas, which could allow unauthorized access to image data from other sites, violating same-origin policy.

Session tokens in RWS WorldServer 11.7.3 and earlier have low entropy, allowing for enumeration. This leads to unauthorized access to user sessions.

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server.

An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.

A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole that leads to an endless loop when a specific malformed descriptor file is input, resulting in a denial of service.

The issue is that checking excessively long DH keys or parameters may be very slow. Applications using the functions DH_check(), DH_check_ex(), or EVP_PKEY_param_check() may experience long delays, which could lead to a Denial of Service attack if the keys or parameters are obtained from an untrusted source.

Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.