2445 matches found
PT-2022-14231
Name of the Vulnerable Software and Affected Versions SourceCodester Product Show Room Site version 1.0 Description A vulnerability was found in the software, declared as problematic. It affects the p=contact parameter. The manipulation of the Message textbox with the input alert1 leads to...
CVE-2020-20971: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index...
PT-2022-8635
Name of the Vulnerable Software and Affected Versions PbootCMS version 2.0.3 Description A Cross Site Request Forgery CSRF issue exists, allowing unauthorized actions to be performed. The issue is exploited via the "/admin.php?p=/User/index" API endpoint. Recommendations For PbootCMS version 2.0....
p-nintendo.com Cross Site Scripting vulnerability OBB-2627700
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-44974
radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/binsymbols.c binary symbol parser...
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic
A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...
PT-2022-37001
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type known as Memcpy-param-overlap. The crash state involves several functions, including repeat, p ere, and cli regcomp...
GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic
A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or P256.ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected...
PT-2022-20097
Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /vloggers merch/?p=view product&id= endpoint, where the id parameter is vulnerable. No information is provided about...
Updated golang packages fix security vulnerability
encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash CVE-2022-24675 crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or...
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
...
SUSE: Security Advisory (SUSE-SU-2022:1411-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLED15 / SLES15 Security Update : go1.18 (SUSE-SU-2022:1410-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1410-1 advisory. - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of...
PT-2022-13852
Name of the Vulnerable Software and Affected Versions Videos sync PDF WordPress plugin versions 1.7.4 and earlier Description The issue arises from the plugin not validating the p parameter before using it in an include statement, potentially leading to Local File Inclusion issues. Recommendation...
CVE-2022-1392: Improper Limitation of a Pathname to a Restricted Directory
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...
GSD-2022-1001243 Bluetooth: hci_serdev: call init_rwsem() before p->open()
Bluetooth: hciserdev: call initrwsem before p-open This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...
PT-2022-29826
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a potential security vulnerability in the Linux Kernel. It involves the hci serdev component, where the init rwsem function is not called before p-open. The actual...
PT-2022-18766
Name of the Vulnerable Software and Affected Versions Student Grading System version 1.0 Description A SQL injection issue was found in the Student Grading System. The issue can be exploited via the "/student-grading-system/rms.php?page=student p&id=" API endpoint, where the id variable is...
AZL-9547 CVE-2022-28327 affecting package golang for versions less than 1.18.3-1
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...
