CVE Vulnerability Catalog

The Admin and Site Enhancements (ASE) WordPress plugin has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 8.0.8.

The Photo Block plugin by Ronald Huereca up to version 1.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects all versions from n/a through 1.5.1.

A vulnerability in SINEMA Remote Connect Server (all versions < V3.2 SP4) allows any user with server access to read private SSL/TLS keys that are not properly protected. This could allow an authenticated attacker to impersonate the server, potentially enabling man-in-the-middle, traffic decryption, or unauthorized access to services that trust these certificates.

IBM QRadar SIEM versions 7.5 through 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update.

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.

A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799). Attacker-supplied data is persistently stored and executed in other users' browsers.

phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.

A cross-site scripting vulnerability was found in GreenCMS 2.3.0603 within the Menu Management Page functionality, in the file /Admin/Controller/CustomController.class.php. Manipulation of the Link argument allows script injection, and the attack can be initiated remotely. The exploit has been published and may be used.

A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. It affects an unknown function of the Local Directory Page component. Manipulation causes cross site scripting. The attack can be initiated remotely and the exploit is publicly available. The vendor was contacted but did not respond. This vulnerability only affects products no longer supported by the maintainer.

Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.

A vulnerability was detected in SourceCodester Online Banking System 1.0. Manipulation of the First Name/Last Name arguments in the file /?page=user results in cross site scripting. The attack can be launched remotely and the exploit is now public.

A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. An unknown function in /membership_profile.php of the Your Info Handler component is affected. Manipulation of the Full Name/Address/City/State arguments results in cross site scripting. The attack can be carried out remotely and the exploit has been made public.

A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnerability is an unknown functionality of the file /dishsub.php. The manipulation of the argument item.name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f in an unknown function of the file /usersub.php of the Request Pending Page component. The manipulation leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Employee Profile Management System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /view_personnel.php. Manipulation of arguments per_address, dr_school, or other_school leads to XSS. The attack can be performed remotely, and the exploit is publicly available.

A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. It affects an unknown function of the file /cgi-bin/api.values.post in the Network Status Page component. Manipulation of the vpn_ip argument results in basic cross site scripting. Remote exploitation is possible and the exploit has been released publicly. The vendor was contacted but did not respond.

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.