CVE Vulnerability Catalog

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing malicious scripts to be executed in the context of other users viewing the affected page.

In Keycloak, a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn't clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

A flaw in Red Hat Openshift AI Service's TrustyAI component grants all service accounts and users cluster-wide permissions to get, list, and watch any pod in any namespace. It also allows access to all persistentvolumeclaims and lmevaljobs.

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

A flaw was found in MaxSite CMS up to 109 affecting unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Manipulation of the file_path/content arguments can lead to unrestricted file upload. The attack can be executed remotely and the exploit has been published. The vendor was contacted but did not respond.

A vulnerability was detected in MaxSite CMS up to 109 affecting unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the HTTP Header Handler component. Manipulation of the X-Requested-FileName/X-Requested-FileUpDir arguments results in unrestricted file upload. Remote exploitation is possible and the exploit is now public. The vendor was contacted but did not respond.

A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet in the Request Header Handler component. Manipulation of the ts/sign argument leads to unrestricted upload, and the attack may be performed remotely.

IBM DB2 High Performance Unload in the listed versions could allow an authenticated user to cause the program to crash due to an out of bounds write.

IBM DB2 High Performance Unload versions 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to incorrect calculation of the size of the data being pointed to.

IBM DB2 High Performance Unload in the listed versions could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.

IBM DB2 High Performance Unload versions 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to incorrect calculation of a buffer size.

A vulnerability was determined in code-projects E-Commerce Website 1.0 affecting an unknown functionality of the file /pages/supplier_update.php. Manipulation of the supp_name/supp_address arguments causes cross site scripting. The attack can be initiated remotely and the exploit has been publicly disclosed.

Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP in specified versions do not limit API access before a user has verified their email address. Remote users can access and edit content via the API without email verification.

A CSRF vulnerability in the Headless API of Liferay Portal and Liferay DXP allows remote attackers to execute any Headless API call via the `endpoint` parameter.

A vulnerability was found in code-projects E-Commerce Website 1.0 affecting an unknown function of the file /pages/product_add.php. Manipulation of the prod_name/prod_desc/prod_cost arguments results in cross site scripting. The attack can be launched remotely and the exploit has been made public.

A vulnerability has been found in code-projects E-Commerce Website 1.0 affecting an unknown function of the file /pages/supplier_add.php. Manipulation of the supp_name/supp_address arguments leads to cross site scripting. The attack can be initiated remotely and the exploit has been disclosed to the public.

eLabFTW versions prior to 5.3.0 served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. The vulnerability is fixed in version 5.3.0.

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to version 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session's token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in version 4.8.0.

Frappe Learning version 2.39.1 and earlier allows users to add HTML through input fields in the Job Form. This could lead to injection of malicious HTML or JavaScript code.

Frappe Learning, a learning management system, in version 2.39.1 and earlier has a security issue where students were able to access the Quiz Form if they had the URL.