CVE Vulnerability Catalog

Auto-GPT is an experimental open-source application that, before version 0.4.3, allowed malicious external resources to trigger misleading messages in the console by using ANSI escape sequences. The issue has been patched in release version 0.4.3.

A vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0, allowing cross site scripting (XSS) attacks through manipulation of the 'un' argument in the /admin/add_user_modal.php file.

A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 that allows cross site scripting (XSS) attacks through manipulation of the firstname/middlename arguments in the file admin/?page=user/manage_user.

An information disclosure issue in Gitlab CE/EE affects all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, and all versions from 16.1 prior to 16.1.1. The issue resulted in the Sidekiq log including webhook tokens when the log format was set to 'default'.

Jenkins Oracle Cloud Infrastructure Compute Plugin version 1.0.16 and earlier does not validate SSH host keys when connecting to OCI clouds, enabling man-in-the-middle attacks.

In JetBrains IntelliJ IDEA before version 2023.1.4, the license dialog could be suppressed in certain cases.

In the music service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.

In the music service, there is a missing permission check, which could lead to local information disclosure with no additional execution privileges needed.

Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access.

A vulnerability in RUGGEDCOM ROX devices (versions < V2.16.0) involves improper handling of malformed HTTP packets. An unauthenticated remote attacker can send such a packet, causing certain functions to fail in a controlled manner.

A vulnerability was found in wallabag 2.5.4 related to an unknown functionality of the file /config of the Profile Config component. Manipulation of the argument Name leads to resource allocation.

A vulnerability was found in GZ Multi Hotel Booking System 1.8 that allows cross site scripting (XSS) attacks through manipulation of the adults/children/cal_id arguments in the /index.php file.

A vulnerability was found in GZ E Learning Platform version 1.8, affecting some unknown processing of the URL Parameter Handler component. Manipulation of this component leads to cross site scripting attacks.

A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 affecting unknown code in the /index.php file. Manipulation of the 'action' argument leads to cross site scripting.

A vulnerability classified as problematic was found in GZ Scripts PHP GZ Hotel Booking Script version 1.8. Manipulation of the arguments first_name, second_name, phone, address_1, and country leads to cross-site scripting attacks.

A vulnerability has been identified in GZ Scripts Ticket Booking Script version 1.8 that allows cross site scripting (XSS) attacks through manipulation of the arguments first_name, second_name, phone, address_1, and country in the /load.php file.

A vulnerability was found in GZ Scripts PHP GZ Appointment Scheduling Script version 1.8 that allows cross-site scripting (XSS) attacks by manipulating the arguments first_name, second_name, phone, address_1, and country in the /load.php file.

A vulnerability has been identified in GZ Scripts Event Booking Calendar version 1.8 that allows cross-site scripting (XSS) attacks through manipulation of the first_name, second_name, phone, address_1, and country arguments in the /load.php file.

A vulnerability was found in GZ Scripts Property Listing Script version 1.0, rated as problematic. The issue affects some unknown processing of the file /preview.php, where manipulation of the argument page/layout/sort_by leads to cross-site scripting.

A vulnerability was found in GZ Scripts Car Listing Script PHP version 1.8, affecting unknown code in the /preview.php file. Manipulation of the page/sort_by argument leads to cross-site scripting.