CVE Vulnerability Catalog

A vulnerability has been found in GstarCAD (up to version 9.4.0) in an unknown function of the file renaming handler component. The manipulation leads to cross-site scripting (XSS). The attack may be initiated remotely, and the exploit has been publicly disclosed.

A security vulnerability was detected in Cudy TR1200 (version 1.16.3-20230804-164635) in an unknown function of /cgi-bin/luci/admin/network/wireless/config/, within the wireless settings component. Manipulation of the SSID argument leads to cross-site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability in code-projects Project Monitoring System 1.0 affects an unknown function in the /onlineJobSearchEngine/postjob.php file. Manipulation of the txtapplyto argument leads to cross-site scripting (XSS). The attack can be launched remotely, and the exploit is publicly available. Other parameters might be affected as well.

A vulnerability was detected in GNU Binutils 2.45 affecting the dump_dwarf_section function in binutils/objdump.c. Manipulation results in an out-of-bounds read. The attack requires local access and the exploit is now public.

A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.

A vulnerability in westboy CicadasCMS 1.0 affects an unknown functionality in the /system/cms/category/save file. Manipulation of the categoryName argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.

A vulnerability in Projectworlds Visitor Management System 1.0 affects the add visitor page (/myform.php). Manipulation of the Name argument leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.

IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user.

A vulnerability was identified in Vvveb (up to version 1.0.7.2) in an unknown function of the SVG file handler component. The cross-site scripting (XSS) flaw can be exploited remotely. The exploit is publicly available and might be used.

IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller versions 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies. The vulnerability enables potential session spoofing or hijacking.

A vulnerability in givanz Vvveb up to 1.0.7.2 affects an unknown functionality of the Configuration File Handler component. Manipulation leads to information disclosure. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability has been found in Total.js CMS (up to version 19.9.0) in an unknown function of the files menu component. The manipulation leads to cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.

In Ogre library up to 14.4.1, the Ogre::LogManager::stream function in OgreLogManager.cpp allows manipulation of the mDefaultLog argument, resulting in a null pointer dereference. The attack requires local access, and the exploit is publicly available.

In BehaviorTree up to 4.7.0, the XMLParser::PImpl::loadDocImpl function in /src/xml_parsing.cpp (XML Parser component) causes a null pointer dereference. The attack can only be performed locally. The exploit is publicly available and may be used.

In BehaviorTree up to 4.7.0, the JsonExporter::fromJson function in /src/json_export.cpp causes a null pointer dereference when manipulating the Source argument. The attack requires local access. The exploit is publicly available, and a patch named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d has been released.

An authenticated user in GitLab CE/EE could gain unauthorized access to confidential issues by creating a project with the same name as the victim's project. It affects versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

A performance degradation issue was discovered in GitLab CE/EE string conversion methods when handling large inputs. It affects versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

A vulnerability was discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

An issue was discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. An authenticated user could create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.

Multiple WSO2 products with Multi-Attribute Login enabled are vulnerable to username enumeration. The system returns a distinct "User does not exist" error message regardless of the validate_username setting, allowing attackers to identify existing accounts. This can aid brute-force attacks, phishing, and social engineering.