Argument Injection in froxlor/froxlor

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended root directory. This could allow an unauthenticated remote attacker to execute file operations of files outside of the specified root folder. Chained with CVE-2022-43513 this could allow Remote Code Execution.

In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.

Improper Handling of Insufficient Permissions or Privileges in usememos/memos

Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.

keycloak: Client Registration endpoint does not check token revocation

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php.

Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php.

Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.

Buffer over-read in Core

Information disclosure due to buffer overread in Core

Buffer overread in Core

Information disclosure due to buffer overread in Core

Stack based buffer overflow in Core

Memory corruption in core due to stack-based buffer overflow

Stack-based buffer overflow in Core

Memory corruption in Core due to stack-based buffer overflow.

Improper input validation in Automotive Android OS

Memory corruption in Automotive Android OS due to improper input validation.

Null pointer dereference in Bluetooth HOST

Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.