CVE-2024-33990

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33989

Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'eventdate' and 'events' parameters in 'port/event_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Event Management System

CVE-2024-33985

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/course/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33986

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in '/department/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33987

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33988

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33984

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33983

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33982

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'StudentID' parameter in '/AttendanceMonitoring/student/controller.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

School Attendence Monitoring System School Event Management System

CVE-2024-33978

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33977

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'view' parameter in /admin/orders/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33976

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'id' parameter in '/admin/user/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33975

Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Young Entrepreneur E-negosyo System

CVE-2024-33958

SQL injection in Janobe E-Negosyo System

SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Enegosyo System Young Entrepreneur E-negosyo System

CVE-2024-34118

Adobe illustrator 2024 TIF File parsing Division by zero denial of service

Illustrator versions 28.5, 27.9.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application denial-of-service condition. An attacker could exploit this vulnerability to render the application unresponsive or terminate its execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Illustrator Macos Windows

CVE-2024-34135

Adobe Illustrator CC 2023 v27.9 Vulnerability II

Illustrator versions 28.5, 27.9.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Illustrator Macos Windows

CVE-2024-33957

SQL injection in Janobe E-Negosyo System

SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Janobe

Products

Enegosyo System Young Entrepreneur E-negosyo System

CVE-2024-34136

Adobe Illustrator PSD File Parsing Null Pointer dereference

Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Illustrator Macos Windows

CVE-2024-34137

Adobe Illustrator 2024 CGM File Parsing Null Pointer Dereference

Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Illustrator Macos Windows

CVE-2024-34138

Adobe Illustrator CGM File Parsing Division By zero

Illustrator versions 28.5, 27.9.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Illustrator Macos Windows