| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue. |
| Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra Standard - L4L China: before 6.0.0.66394. |
| Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue. |
| Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue. |
| Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts. |
| Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force.
This issue affects Expert Mail: through 2026-09-18. |
| A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. |
| Memory corruption when processing draw objects of incorrect type during graphics command list execution. |
| Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization. |
| HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior. |
| Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed. |
| Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. |
| Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. |
| Memory Corruption when processing camera operations due to out-of-bounds write during driver updates. |
| Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. |
| Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. |
| Memory corruption when non-secure loader rewrites page tables before secure memory initialization. |
| Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters. |
| A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely. |
| A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. |
