CVE Vulnerability Catalog

In Audio HAL, there is a possible escalation of privilege due to use-after-free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed.

In the Modem module, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.

In the Modem module, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.

In the Modem module, there is a possible system crash due to improper input validation. This could lead to local denial of service, but requires user execution privileges and user interaction.

A vulnerability was found in projectworlds Online Examination System 1.0 in the Feedback Form component, in the feedback.php file. Manipulating the Name/Subject arguments leads to cross-site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in openagents up to version 0.8.19/0.9.3.post20 in the test_default_model function of the file sdk/src/openagents/sdk/transports/http.py. Manipulating the base_url argument results in server-side request forgery (SSRF). The attack can be initiated remotely, and the exploit has been made public.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pro_transac.php?action=add. Manipulating the Name argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0 in the file /pages/pos_transac.php?action=add. Manipulating the Customer argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0 in the file /pages/cust_transac.php?action=add. Manipulating the firstname argument results in SQL injection. The attack can be launched remotely, and the exploit is now public.

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0 in the file /pages/us_del.php?type=user. Manipulating the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed publicly.

Vulnerability in itsourcecode Sales and Inventory System 1.0. An unknown functionality in /pages/sup_del.php?type=supplier is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in JeecgBoot up to version 3.9.3. The exportXls function in AiragModelController.java is vulnerable to improper access controls via the credential argument. The attack can be performed remotely, and the exploit is publicly disclosed. Upgrading to version 3.9.5 is recommended.

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows a table owner to execute arbitrary code with superuser privileges. The issue is fixed in version 3.2.0 and later.

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document with specially crafted object names. If a superuser calls anon.import_database_rules() or anon.import_roles_rules(), malicious code is executed with superuser privileges. Fixed in version 3.1.4 and later.

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It affects an unknown function of the file /ht/hotel_db%20(1).sql in the Database Backup Handler component. The manipulation results in information disclosure. The attack can be launched remotely. The exploit is public and may be used.

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It impacts an unknown function of the file /ht/details.php. Manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php in the Logout Handler component. Manipulation of the argument log_out leads to session expiration. The attack can be launched remotely. The exploit is publicly available. This product uses rolling releases, so version details are not available. The project was informed but has not responded.

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.