CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the /contacts/listcontacts.php component. Attackers can inject arbitrary web scripts or HTML via the Last Name field when adding a contact.

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /linkedcontent/listfiles.php. Attackers can inject arbitrary web scripts or HTML into the Name field after clicking 'Add'.

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.

Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.

Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Announcement function. Attackers can inject arbitrary JavaScript or HTML into the Title field, leading to script execution in other users' browsers.

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.

Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.

Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

The Amasty Blog Pro plugin versions 2.10.3 and 2.10.4 for Magento 2 contain a Stored Cross-site Scripting (XSS) vulnerability due to the duplicate post function.

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. Upgrading past commit b1a2cd50c0357f243b7435a732b4e62ba3157a2e is recommended.

Amasty Blog version 2.10.3 is vulnerable to Cross-Site Scripting (XSS) via the leave comment functionality. This allows an attacker to inject malicious JavaScript code into the page.

A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.

An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.