CVE Vulnerability Catalog

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

A vulnerability in seakee CPA-Manager-Plus up to 1.11.10 affects the CPAResource function in the file apps/manager-server/internal/http/controller/proxy/handler.go of the HTTP Handler component. The manipulation leads to improper authorization. The attack can be initiated remotely.

A vulnerability in itsourcecode Sales and Inventory System 1.0 affects an unknown part of the file /pages/us_edit.php. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability in ningzichun Student Management System (up to a specific commit) affects the session_start function in login.php. The manipulation results in session fixation. The attack can be launched remotely, and the exploit is public. The product does not use versioning, so affected and unaffected release details are unavailable.

A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

An out-of-bounds read vulnerability in Skype for Business allows an authorized attacker to deny service over a network.

A vulnerability in Skype for Business that generates error messages containing sensitive information allows an unauthorized attacker to disclose information over a network.

A null pointer dereference vulnerability in Skype for Business allows an authorized attacker to deny service over a network.

A cross-site scripting (XSS) vulnerability in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible temporary denial of service due to an integer overflow. This can be exploited remotely without additional privileges or user interaction.

In the initForUserNoTracing function in VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service without additional execution privileges. User interaction is not needed for exploitation.

In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service without additional execution privileges. User interaction is not needed.

In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error. This could lead to local denial of service without additional execution privileges. User interaction is not needed.

A CSRF vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the administrator. There is no confidentiality impact.

A vulnerability in ningzichun Student Management System (up to a specific commit) affects an unknown function in the file example.7z of the Backup Handler component. The manipulation leads to information disclosure. The attack can be initiated remotely, and the exploit is public. The product uses continuous delivery with rolling releases, so no version details are available.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.