CVE Vulnerability Catalog

In itsourcecode Fees Management System 1.0, an XSS vulnerability exists in an unknown function of index.php. Manipulating the page argument leads to client-side script execution. The attack can be performed remotely, and the exploit is publicly available.

In eLabFTW before version 5.4.2, an authenticated user performing a numeric reference/search can return results that include resources the user is not authorized to view. The exposed information is limited to titles, but may include sensitive data such as project names or patient identifiers.

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0 allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms, allowing an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has a stored XSS vulnerability in Secure Data Forms, allowing an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership.

A vulnerability was identified in Fees Management System 1.0 in the file /manage_course.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

The Fees Management System version 1.0 has an SQL injection vulnerability in /ajax.php via the Username argument. The attack can be performed remotely and the exploit is public.

Memory corruption occurs when sending a random number generator command with an insufficient output buffer size.

Memory corruption occurs when the output buffer size is smaller than the input buffer size during a data copying operation.

Memory corruption in Windows drivers when sending an incorrect trusted application request.

Memory corruption in diagnostic services due to lack of input validation.

Memory corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

Information disclosure occurs when processing advertisement frames with malformed MBSSID elements of insufficient length.

Information disclosure occurs when resetting a device to factory default settings through the Powerline interface, allowing unauthorized access to device configuration.

In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local escalation with User execution privileges needed. User interaction is needed for exploitation.

In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.

A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

The Enderfga claw-orchestrator up to version 3.7.0 has a vulnerability in the validateRegex function of claw-orchestrator/src/embedded-server.ts. Manipulating the body.pattern argument leads to inefficient regular expression complexity, exploitable remotely.

In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.