CVE Vulnerability Catalog

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository omeka/omeka-s prior to version 4.0.4, allowing for the storage of malicious code.

Improper authorization of an index containing sensitive information exists in the GitHub repository omeka/omeka-s prior to version 4.0.4.

A critical vulnerability has been found in Bettershop LaikeTui, allowing unrestricted file uploads through manipulation of functionality in the file index.php?module=api&action=user&m=upload. The attack can be launched remotely.

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.

A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.

IBM Storage Copy Data Management versions 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

A critical vulnerability was found in the Online Graduate Tracer System 1.0, affecting the mysqli_query function in the sexit.php file. Manipulation of the id argument leads to SQL injection, which can be launched remotely.

A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3 in an unknown function of the /search file handling the GET parameter. Manipulation of the filter[brandid] argument leads to SQL injection. The attack may be performed remotely, and the exploit has been publicly disclosed.

A critical vulnerability was found in IBOS OA version 4.5.5, allowing SQL injection through manipulation of the file ?r=recruit/bgchecks/export&checkids=x.

A vulnerability was found in Byzoro Smart S85F Management Platform up to version 20230809, rated as problematic. The issue affects some unknown processing of the file /config/php.ini, leading to direct requests.

A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=recruit/contact/export&contactids=x. Manipulation of this code leads to SQL injection.

A critical vulnerability was found in D-Link DAR-8000-10 up to version 20230809, affecting the file /app/sys1.php. Manipulation of the cmd argument with input id leads to remote OS command injection.

A vulnerability in the Connect Mobility Router component of MiVoice Connect through version 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration.

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through version 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization.

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization.

The 'Open Redirect' vulnerability in the FORM authentication feature of Apache Tomcat allows redirecting users to untrusted sites. This affects Apache Tomcat versions from 11.0.0-M1 to 11.0.0-M10, from 10.1.0-M1 to 10.0.12, from 9.0.0-M1 to 9.0.79, and from 8.5.0 to 8.5.92.

Pyramid is an open source Python web framework. A path traversal vulnerability in versions 2.0.0 and 2.0.1 may disclose the `index.html` file if it is placed in the correct location relative to the static view.

Notepad++ versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining`. Exploitation of this vulnerability may lead to leaking internal memory allocation information.

Notepad++ versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. Exploitation of this vulnerability may lead to leaking internal memory allocation information.