| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue. |
| Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30. |
| NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3. |
| NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compared using direct string equality. This issue has been patched in version 0.301.3. |
| NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3. |
| NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3. |
| Transient DOS when an LTE RLC packet with invalid TB is received by UE. |
| Memory Corruption when accessing buffers with invalid length during TA invocation. |
| Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
| Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
| Transient DOS when MAC configures config id greater than supported maximum value. |
| Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
| An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd. |
| sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
| sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
| Memory Corruption when adding user-supplied data without checking available buffer space. |
| Memory Corruption when processing invalid user address with nonstandard buffer address. |
| Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. |
| Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs. |
| Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
