CVE Vulnerability Catalog

The vulnerability allowed a website to obscure the fullscreen notification by using a URL handled by an external program, which could lead to user confusion and potential spoofing attacks.

The use of TikaEncodingDetector in Apache Any23 can lead to excessive memory usage.

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.

Bouncy Castle for Java before version 1.74 is affected by an LDAP injection vulnerability. This vulnerability affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates, where the certificate's Subject Name is inserted into an LDAP search filter without proper escaping.

A critical vulnerability was found in SmartWeb Infotech Job Board version 1.0, affecting some unknown functionality of the file /settings/account in the My Profile Page component. Manipulation of the argument filename leads to unrestricted file uploads.

A critical vulnerability has been found in SourceCodester Shopping Website 1.0, related to an unknown functionality of the file insert-product.php. Manipulation of this functionality leads to unrestricted file uploads.

A critical vulnerability was found in SourceCodester Shopping Website version 1.0, affecting an unknown function in the file search-result.php. Manipulation of the argument 'product' leads to SQL injection.

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.

All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with the document, such as the password.

Affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. An attacker with 'user' privileges could access files requiring higher privileges by establishing an SSH session and providing the other tokens.

Affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values.

Maxsite CMS version 108.7 has a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.

A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.

Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

Affected TBox RTUs store hashed passwords using MD5 encryption, which is considered insecure.

Knowage is a professional open source suite for data analytics that has a vulnerability in versions 6.x.x and prior to 8.1.8. It allows authenticated users to download template files, but the lack of sanitization of the '_templateName_' parameter enables attackers to download any file from the system.

An out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to version 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device.

2FA is a web application for managing Two-Factor Authentication (2FA) accounts and generating security codes. Cross site scripting (XSS) injection can be performed via the account/service field.

An unquoted Windows search path vulnerability existed in the install service of MOVE 4.10.x and earlier versions. The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path, leading to privilege escalation and the ability to stop antimalware services.