CVE Vulnerability Catalog

GLPI is a free asset and IT management software package. In versions from 9.4.0 to prior to 10.0.8, a malicious link can be crafted by an unauthenticated user, leading to a reflected XSS vulnerability if any authenticated user opens the crafted link.

GLPI is a free asset and IT management software package. Versions from 9.2.0 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to view all KnowbaseItems.

AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

AMI SPx contains a vulnerability in the BMC where an attacker may cause an improper neutralization of CRLF sequences in HTTP headers. A successful exploit of this vulnerability may lead to a loss of integrity.

AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss of confidentiality, integrity, and authentication.

In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.

GLPI is a free asset and IT management software package. Versions from 0.68 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to the list of all users and their personal information.

CVE-2023-33335 describes a Cross Site Scripting (XSS) vulnerability in Sophos iView software, allowing arbitrary script execution in the grpname parameter. This software reached its end of life on December 31, 2020.

An Open Redirect vulnerability exists in the GitHub repository go-gitea/gitea prior to version 1.19.4.

There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.

A vulnerability in ArubaOS allows an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the user's existing privilege level.

Vulnerabilities exist that allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the user's existing privilege level.

An authenticated path traversal vulnerability exists in ArubaOS. Successful exploitation allows for the deletion of arbitrary files in the underlying operating system.

In Firefox, when configured to block the storage of all cookies, it was still possible to store data in localstorage using an iframe with a source of 'about:blank'. This could lead to malicious websites storing tracking data without user consent.

The TN-5900 Series version 3.3 and prior is vulnerable to a user enumeration vulnerability. This vulnerability may allow a remote attacker to determine if a user is valid during password recovery through the web login page.

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox versions below 115.

The vulnerability allows an attacker to trick a user into submitting sensitive data to a malicious website by uploading files that contain symlinks. This affects Firefox versions below 115.

The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox versions below 115.

A vulnerability in Firefox (< 115) allows a website to obscure the fullscreen notification by using an option element, potentially causing delays due to an expensive computational function. This could lead to user confusion and possible spoofing attacks.