CVE Vulnerability Catalog

Movary, a web application to track, rate and explore movie watch history, prior to 0.69.0 accepts a redirect parameter without validation on the login page, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.

Movary, a web application to track, rate and explore movie watch history, up to version 0.68.0 uses the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). An attacker can execute arbitrary JavaScript in a user's browser by including a malicious payload in the "code" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script executes in their browser.

A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field.

An arbitrary file upload vulnerability exists in the Data Preparation function of AIxBlock commit f60975. Attackers can upload a crafted SVG file to execute arbitrary code.

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

Dell Secure Connect Gateway (SCG) 5.0 (versions 5.26.00.00 - 5.30.00.00) contains a relative path traversal vulnerability in the internal collection download REST API, if enabled by an admin. A low privileged attacker with remote access can exploit this to access restricted resources.

Dell Secure Connect Gateway (SCG) Policy Manager versions 5.20, 5.22, 5.24, 5.26, 5.28 contain a Cross-site Scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.

Credits Page not Matching Versions in Use in the Firmware. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Certain HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited under certain conditions, e.g., when an NFC device (such as a smartphone/smartwatches) is in proximity during a card swipe event.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. The vulnerability allows injection of malicious script that is stored and executed in the user's browser.

Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. The vulnerability allows storage of malicious script that is executed in the user's browser.

Zohocorp ManageEngine Exchange Reporter Plus through 5721 is vulnerable to ReDoS in the search module.

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication. This issue was fixed in version 1.1.24.

Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. A malicious attacker can craft a special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. The software does not implement any protection against this type of attack, and all forms are potentially vulnerable. Only version 6.7 was tested and confirmed as vulnerable.

A user with CREATE but no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

The example DAG `example_dag_decorator` in Apache Airflow had a non-validated parameter that allowed a UI user to redirect the example to a malicious server and execute code on a worker. This required example DAGs to be enabled in production (not default) or the example code to be copied into a custom DAG.

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.