CVE Vulnerability Catalog

A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the setMainSource function. Manipulation of this function leads to OS command injection.

A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the changedSource function. Manipulation of this function leads to improper access controls.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2 related to TLS certificate validation. The validation does not always consider whether the root of a chain is a configured CA certificate.

DokuWiki before version 2023-04-04a allows XSS via RSS titles.

Improper Access Control exists in GitHub repository nilsteampassnet/teampass prior to version 3.0.9.

A critical vulnerability has been found in the Agro-School Management System 1.0. Manipulation of the argument question_id in the doUpdateQuestion function of the btn_functions.php file leads to SQL injection.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function, allowing unauthenticated attackers to update post content and inject malicious JavaScript.

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to and including 1.27.133. This allows authenticated attackers to create posts of any type and status.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post', and 'azh_remove_post' functions.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via 'azh_post' shortcode in versions up to and including 1.27.133 due to insufficient input sanitization and output escaping.

eMedia Consulting simpleRedak up to version 2.47.23.05 was discovered to contain a reflected XSS vulnerability via the component /scheduler/index.php.

eMedia Consulting simpleRedak up to version 2.47.23.05 was found to contain a reflected XSS vulnerability via the component /view/cb/format_642.php.

A Cross-site Scripting (XSS) vulnerability was identified in the GitHub repository tsolucio/corebos prior to version 8 via evvtgendoc.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.

A Cross-site Scripting (XSS) vulnerability - Stored in the GitHub repository tsolucio/corebos prior to version 8.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.

An attacker could have positioned a datalist element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

A vulnerability in the RLBox Expat driver involves an out-of-bounds read that could lead to a crash. This affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.