U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
There are 229,277 matching records.
Displaying matches 901 through 920.
Vuln ID Summary CVSS Severity
CVE-2024-28045

Improper neutralization of input within the affected product could lead to cross-site scripting.

Published: March 21, 2024; 7:15:10 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28040

SQL injection vulnerability exists in GetDIAE_astListParameters.

Published: March 21, 2024; 7:15:10 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-25567

Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.

Published: March 21, 2024; 7:15:10 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-23975

SQL injection vulnerability exists in GetDIAE_slogListParameters.

Published: March 21, 2024; 7:15:09 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-23494

SQL injection vulnerability exists in GetDIAE_unListParameters.

Published: March 21, 2024; 7:15:09 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2023-42954

A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests.

Published: March 21, 2024; 7:15:09 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-2769

A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257605 was assigned to this vulnerability.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-2768

A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257604.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28891

SQL injection vulnerability exists in the script Handler_CFG.ashx.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28521

SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive information via a crafted script to the loginid parameter of the /singlelogin.php component.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28119

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28118

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.

Published: March 21, 2024; 6:15:12 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28117

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.

Published: March 21, 2024; 6:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28116

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.

Published: March 21, 2024; 6:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-28029

Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.

Published: March 21, 2024; 6:15:11 PM -0400
V3.1: 8.8 HIGH
V2.0:(not available)
CVE-2024-27921

Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.

Published: March 21, 2024; 6:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-25937

SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.

Published: March 21, 2024; 6:15:10 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-24272

An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret.

Published: March 21, 2024; 6:15:10 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-2767

A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257603.

Published: March 21, 2024; 5:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)
CVE-2024-2766

A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257602 is the identifier assigned to this vulnerability.

Published: March 21, 2024; 5:15:11 PM -0400
V3.x:(not available)
V2.0:(not available)