CVE Vulnerability Catalog

ProcessWire v3.0.200 was found to have multiple XSS vulnerabilities in the Search Users and Search Pages functions. These flaws allow attackers to inject arbitrary JavaScript or HTML.

Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page. This allows an attacker to inject malicious scripts through improperly sanitized input fields.

A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.

Multiple stored cross-site scripting (XSS) vulnerabilities were found in Train Scheduler App v1.0. Attackers can inject malicious JavaScript or HTML into the Train Code, Train Name, and Destination text fields.

A flaw in drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.

In the Linux kernel, a vulnerability was identified in the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c, in the Ethernet Handler component. Manipulation leads to a use-after-free. A patch is available, but no released kernel version was ever affected by this CVE.

A critical vulnerability was found in the Linux kernel in the tst_timer function of drivers/atm/idt77252.c, in the IPsec component. The manipulation leads to use after free. Applying a patch is recommended to fix this issue.

A buffer overflow vulnerability in STMicroelectronics stm32_mw_usb_host before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using an RTOS such as FreeRTOS on STM32 MCUs.

A critical vulnerability was found in the Linux kernel affecting the devlink_param_set/devlink_param_get functions in net/core/devlink.c within the IPsec component. The manipulation leads to a use-after-free condition. Applying a patch is recommended to fix this issue.

A vulnerability was found in the Linux Kernel in the nilfs_bmap_lookup_at_level function of the file fs/nilfs2/inode.c, related to the nilfs2 component. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

Cross Site Scripting (XSS) vulnerability in the New equipment page of EasyVista Service Manager 2018.1.181.1 allows remote attackers to execute arbitrary code via the notes field.

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

A use-after-free flaw was found in the Linux kernel's networking code, specifically in the sch_sfb enqueue function. The function used the socket buffer (SKB) cb field after the same SKB had already been enqueued and freed into a child qdisc. This allows a local, unprivileged user to crash the system.

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded SVG file.

A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.

A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the name or namespace parameter.

Cross-site scripting (XSS) vulnerability in the Object module of Liferay Portal 7.4.3.4 through 7.4.3.36. Remote attackers can inject arbitrary web script or HTML via the `Label` text field on the edit object details page.

A cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal and DXP allows remote attackers to inject arbitrary web script or HTML.

A Cross-site scripting (XSS) vulnerability in the Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through 36. Remote attackers can inject arbitrary web script or HTML via the `redirect` parameter.

A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.