CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function. This flaw allows an attacker to trigger a buffer overflow, causing a denial of service and possibly enabling code execution.

A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in a guest on an Intel CPU.

A vulnerability classified as problematic was found in TrueConf Server 4.3.7. It affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the msg parameter in the register_visitor script. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.

A Cross Site Scripting (XSS) vulnerability has been discovered in Ruckus Wireless ZoneDirector version 9.8.3.0. It allows a remote attacker to inject malicious scripts into the management interface.

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

Persistent XSS in Galaxkey Secure Mail Client up to version 5.6.11.5 allows an attacker to intercept an HTTP POST request when sending an email and inject a crafted XSS payload in the 'subject' field, which executes when the recipient logs into their mailbox.

Missing access control in the backup system of Telesoft VitalPBX before version 3.2.1 allows attackers to access PJSIP and SIP extension credentials, cryptographic keys, and voicemail files via unspecified vectors.

Protobuf-c v1.4.0 contains an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Unioncms version 1.0.13 contains a stored XSS vulnerability in the Default settings. An attacker can inject a malicious script that will be executed in the administrator's browser.

ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.

Incomplete cleanup in specific special register write operations for some Intel processors may allow an authenticated user to potentially enable information disclosure via local access.

Incomplete cleanup of microarchitectural fill buffers on some Intel processors may allow an authenticated user to potentially enable information disclosure via local access.

Incomplete cleanup of multi-core shared buffers for some Intel processors may allow an authenticated user to potentially enable information disclosure via local access.

PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. An authenticated administrator can inject a malicious SQL query, affecting application logic and retrieving database information.

In lock_sock_nested in sock.c, a use-after-free is possible due to a race condition. This could lead to local privilege escalation with System execution privileges needed, without user interaction.