CVE-2014-125038

IS_Projecto2 NewsBean.java sql injection

A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217192.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Is Projecto2 Project

Products

Is Projecto2

CVE-2010-10003

gesellix titlelink plugin_content_title.php sql injection

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is named b4604e523853965fa981a4e79aef4b554a535db0. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217351.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Titlelink Project

Products

Titlelink

CVE-2016-15009

OpenACS bug-tracker Search nav-bar.adp cross-site request forgery

A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is aee43e5714cd8b697355ec3bf83eefee176d3fc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217440.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openacs

Products

Bug-tracker

CVE-2021-4305

Woorank robots-txt-guard patterns.js makePathPattern redos

A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.

CVSS 3.1 · 3.5 Low EPSS 1.0% KEV · Not listed

Vendors

Bridgeline

Products

Robots-txt-guard

CVE-2024-9787

Contemporary Control System BASrouter BACnet BASRT-B UDP Packet denial of service

A vulnerability, which was classified as problematic, was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This affects an unknown part of the component UDP Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ccontrols Contemporary Control System

Products

Basrouter Bacnet Basrt-b Basrouter Bacnet Basrt-b Firmware Basrouter Bacnet Basrt-b

CVE-2015-10016

jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection

A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opensim-utils Project

Products

Opensim-utils

CVE-2014-125050

ScottTZhang voter-js main.js sql injection

A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Voter-js Project

Products

Voter-js

CVE-2018-25069

Netis Netcore Router hard-coded password

A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Netis-systems

Products

Netcore Router Netcore Router Firmware

CVE-2024-6811

IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WSQ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24192.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview Wsq

CVE-2024-9261

IrfanView SID File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

IrfanView SID File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23283.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2024-6812

IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WSQ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23273.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview Wsq

CVE-2024-9260

IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23280.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2024-9258

IrfanView SID File Parsing Uninitialized Pointer Remote Code Execution Vulnerability

IrfanView SID File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SID files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23276.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2024-9259

IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

IrfanView SID File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SID files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23278.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2015-10023

Fumon trello-octometric srv.go main sql injection

A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Trello-octometric Project

Products

Trello-octometric

CVE-2015-10028

ss15-this-is-sparta Main Page roomElement.js cross site scripting

A vulnerability has been found in ss15-this-is-sparta and classified as problematic. This vulnerability affects unknown code of the file js/roomElement.js of the component Main Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is ba2f71ad3a46e5949ee0c510b544fa4ea973baaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217624.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Pear Programming Project

Products

Pear Programming

CVE-2021-4307

Yomguithereal Baobab prototype pollution

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.

CVSS 3.1 · 6.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Baobab Project

Products

Baobab

CVE-2022-1101

SourceCodester Royale Event Management System userregister.php improper authentication

A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authentication. The attack may be initiated remotely. The identifier VDB-195785 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed

Vendors

Event Management System Project

Products

Event Management System

CVE-2023-0246

earclink ESPCMS Content cross site scripting

A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Espcms

Products

Espcms

CVE-2009-10002

dpup fittr-flickr EXIF Preview easy-exif.js cross site scripting

A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the file fittr-flickr/features/easy-exif.js of the component EXIF Preview Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 08875dd8a2e5d0d16568bb0d67cb4328062fccde. It is recommended to apply a patch to fix this issue. The identifier VDB-218297 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Fittr Flickr Project

Products

Fittr Flickr