CVE Vulnerability Catalog

An information leak vulnerability in THE_B_members card version 13.6.1 allows attackers to obtain the channel access token and send crafted messages.

An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token. With this token, they can send crafted messages.

An information leak vulnerability in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token. This token can be used to send crafted messages.

An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

A use-after-free flaw has been found in glibc's getaddrinfo function. In an extremely rare scenario where an NSS module implements only specific hooks and the query meets certain conditions, an application crash may occur.

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.

Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.

A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.

In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.

In GLib, GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

A flaw was found in GLib's GVariant deserialization code, causing a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib but affects distributors who backported the initial fix.

In glib, the gvariant deserialization code is vulnerable to denial of service due to additional input validation introduced to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but affects distributors who backported the initial fix for CVE-2023-29499.

A flaw was found in GLib related to GVariant deserialization. A crafted GVariant can cause excessive processing, leading to denial of service.

In GLib, GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. The vulnerability affects processing of untrusted GVariant data.

There is a failure in the -fstack-protector feature in GCC-based toolchains targeting AArch64, allowing an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without detection. This issue only affects C99-style dynamically-sized local variables or those created using alloca().

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.

Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in the license class configuration, leading to the generation of hardcoded and predictable symmetric encryption keys for license generation and validation. This allows an attacker to reconstruct the keys and forge licenses.