CVE Vulnerability Catalog

php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 lack authentication in the enrollment status handler (GET /enroll/status). An unauthenticated remote attacker can retrieve an approved peer's signed Biscuit identity token by supplying a peer_id from the unauthenticated GET /info endpoint, then replay it as a bearer credential to read authorization policies and overwrite router multiaddrs.

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified.

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. SSH options set via set_openssh_opt do not reach this command, so no configuration restores host key checking for the transfer.

A vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access to compromise confidentiality and integrity. It can be exploited through APIs in the component, such as a web service supplying data to the APIs.

In Laravel before 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account.

In Laravel from 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity.

Pillow versions 11.2.1 through 13.0.0 incorrectly assume image rows are tightly contiguous when exporting to Arrow. When PILLOW_ALIGNMENT causes row padding or an aligned offset before the first row, the resulting Arrow buffer may include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. This can disclose one user's pixels or other process memory to another user.

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

In TOTOLINK EX200 5.2.3c.7200, the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi of the wireless.so component is vulnerable to a stack-based buffer overflow via manipulation of the macAddress argument. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

In TOTOLINK EX200 5.2.3c.7200, the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi of the lan.so component is vulnerable to a stack-based buffer overflow via manipulation of the Comment argument. The attack can be launched remotely, and the exploit has been released to the public and may be used for attacks.

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A vulnerability in the Perl Robots::Validate library (versions 0.4.3 to 0.4.10) allows the state of the Aho-Corasick matcher used for User-Agent matching to persist across requests. If a User-Agent ends partway through a robot name, the next User-Agent checked by the same object can complete that name, causing misclassification of the client as a robot.

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler, which sizes a DIB allocation from 16-bit-truncated dimensions but copies pixel data using the original full dimensions, allowing a heap buffer over-read.

In Pillow from 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. Because src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

In Pillow prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.