CVE Feed

School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index.php?view=edit&id=.

Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point.

Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point.

Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial of service attack through a carefully constructed http request.

In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remote code execution (RCE).

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters.

A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.

A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. VDB-212346 is the identifier assigned to this vulnerability.

A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347.

Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend.exception_ignore_args = On` as an option in `php.ini`.

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user.

CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app.

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.