Open Redirect in ikus060/rdiffweb

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

Reflected XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability.

Reflected POST XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability.

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

SourceCodester Sanitization Management System Admin Login sql injection

A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216739.

Incorrect Use of Privileged APIs in usememos/memos

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

Improper Restriction of Excessive Authentication Attempts in usememos/memos

Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.

Gotify server XSS vulnerability in the application image file upload

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Realtek GPON router - Command Injection

Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Improper Verification of Source of a Communication Channel in usememos/memos

Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

Insufficient Granularity of Access Control in usememos/memos

Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

NVIDIA distributions of Linux contain a vulnerability in nvdla_emu_task_submit, where unvalidated input may allow a local attacker to cause stack-based buffer overflow in kernel code, which may lead to escalation of privileges, compromised integrity and confidentiality, and denial of service.

HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect Authorization

The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnerability to bypass the intended access restrictions, to make API functions calls, manipulate system and terminate service.

Possible Reflected and Stored XSS in OpenText iManager

Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000.