CVE Vulnerability Catalog

A vulnerability was found in itsourcecode Construction Management System 1.0 affecting an unknown function of /equipments.php. Manipulation of the Name argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A SQL Injection vulnerability was found in itsourcecode Construction Management System 1.0 in the /employees.php file. Manipulation of the Name argument allows injection of malicious SQL code. The attack can be performed remotely, and the exploit has been publicly disclosed.

ChurchCRM prior to 7.0.0 allowed creating links that, when an authenticated user clicked the 'Cancel' button, would redirect them to any URL chosen by an attacker. The issue affects all instances using the 'linkBack' parameter, with DonatedItemEditor.php given as an example. The vulnerability is fixed in 7.0.0.

In HAProxy before version 3.3.6, a vulnerability was found in the HTTP/3 parser. It does not verify that the received body length matches a previously declared Content-Length header when the stream is closed via a frame with an empty payload. The issue exists since version 2.6.

The bson_validate function may return early on specific inputs and incorrectly report success. This could skip validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue affects MongoDB C Driver versions prior to 1.30.5, and versions 2.0.0 and 2.0.1.

Cross-Site Scripting vulnerability in Snipe-IT asset management system versions 8.3.0 through 8.3.1. An authenticated attacker with minimal privileges can inject arbitrary JavaScript code via the "Name" and "Surname" fields. The code executes when the Activity Report or a modified profile is viewed by other users with sufficient permissions, provided the profile has no Display Name set.

In HCL DevOps Velocity, the rate limiting mechanism for login attempts is not properly enforced, allowing brute-force attacks after exceeding the unsuccessful login attempt limit. This vulnerability is fixed in version 5.1.7.

In the Linux kernel's netfilter nfnetlink_log, an uninitialized heap memory leak was found in the NFULA_PAYLOAD attribute. The __build_packet_message() function manually constructs the attribute, copying only payload data without zeroing the padding bytes, leaking kernel heap contents to userspace.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to the use of an uninitialized rtp_addr variable in the process_sdp function. When the SDP body lacks active media descriptions, the variable remains uninitialized, causing SIP session addresses to be overwritten with arbitrary stack data.

In the Linux kernel, a vulnerability in the netfilter x_tables subsystem allows xt_match and xt_target extensions registered with NFPROTO_UNSPEC to be loaded by the ARP protocol family. Due to mismatched hook masks (NF_INET_* vs NF_ARP), validation passes incorrectly, leading to NULL pointer dereference and kernel panic.

In the Linux kernel, the HFSC network scheduler (sch_hfsc) is vulnerable to a divide-by-zero in rtsc_min(). The issue occurs when the difference of two 64-bit scaled values exceeds 2^32 and is stored in a 32-bit variable, truncating it to zero and causing a division error.

A vulnerability was found in the Linux kernel's flow classifier (cls_flow) for shared QoS blocks. The flow_change() function calls tcf_block_q() and dereferences q->handle, which is NULL for shared blocks, causing a NULL pointer dereference and system crash.

In the Linux kernel, a NULL pointer dereference was found in the cls_fw classifier when using filters on shared blocks. The issue occurs when an empty cls_fw filter is attached to a shared block and a packet with a nonzero skb mark is classified, causing a system crash.

W jądrze systemu Linux zidentyfikowano podatność, która pozwala na przekazanie wartości interwału równiej zeru do funkcji br_mrp_start_test() i br_mrp_start_in_test(), co prowadzi do pętli, która wyczerpuje pamięć systemową i powoduje panikę jądra. Problem ten dotyczy również funkcji br_mrp_start_in_test_parse() dla ramek testowych interkonektów.

In the Linux kernel, in the netfilter: ipset subsystem, a vulnerability was found in the mtype_del function that incorrectly handles logically empty buckets. The function failed to release a bucket when all entries were removed but the n->pos pointer still pointed past deleted slots.

In the Linux kernel, in the netfilter subsystem (nfnetlink_log), a bug was found in the size calculation of NLMSG_DONE messages. The netlink header size is not accounted for, which can trigger a WARN splat and drop the message.

A vulnerability in the Linux kernel's ip6_datagram_send_ctl() function for IPv6 allows a 16-bit opt_flen accumulator to overflow when multiple IPV6_DSTOPTS control messages are sent. This causes header size underestimation and triggers a kernel panic via skb_under_panic(), leading to a local DoS.

A Stored Cross-Site Scripting (XSS) vulnerability in Apache Storm UI allows topology metadata (component IDs, stream names, grouping values) to be interpolated into HTML without sanitization via parseNode() and parseEdge(). An authenticated user with topology submission rights can craft a topology containing malicious HTML/JavaScript in component identifiers, which is then executed in an operator's or administrator's browser.

A vulnerability in the Palo Alto Networks Cortex XDR agent for Windows allows a local Windows administrator to disable the agent. The issue stems from a flaw in the protection mechanism.

Out-of-bounds write vulnerability in the WEB module. Successful exploitation will affect availability and confidentiality.