p-beseda.ru Cross Site Scripting vulnerability OBB-2744261

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1996)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...

Cisco Unified Communications Manager IM & Presence File Read Vulnerability (isco-sa-cucm-imp-afr-YBFLNyzd)

The version of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P installed on the remote host is prior to 14SU2. It is, therefore, affected by a file read vulnerability. Due to insufficient file permissions, an authenticated remote attacker could read arbitrary files on t...

GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic

The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...

GSD-2022-1003991 nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags

nvme-pci: fix a NULL pointer dereference in nvmeallocadmintags This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.283 by commit...

validate-data denial-of-service vulnerability (CNVD-2022-66399)

validate-data is a NodeJs backend library by Anoop P R Individual Developer. It is used to validate data according to the provided rules. A denial of service vulnerability exists in validate-data version v0.1.1, which stems from not properly handling incoming error messages and can be exploited b...

PT-2022-3157 · Emerson · Emerson Deltav Distributed Control System

Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 Description: The issue is related to the misuse of passwords and the presence of hardcoded credentials in the FTP service of the Emerson DeltaV...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1930)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2022-1890)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-14844)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-14844 advisory. go-toolset 1.17.10-1 - Set version to correspond to the matching build golang version - delve can be now added to aarch64 as well, remove ifarch. gola...

CVE-2022-1979: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input leads to cross site scripting. The attack can be initiated remotely but requires authentication...

PT-2022-14231

Name of the Vulnerable Software and Affected Versions SourceCodester Product Show Room Site version 1.0 Description A vulnerability was found in the software, declared as problematic. It affects the p=contact parameter. The manipulation of the Message textbox with the input alert1 leads to...

PT-2022-8635

Name of the Vulnerable Software and Affected Versions PbootCMS version 2.0.3 Description A Cross Site Request Forgery CSRF issue exists, allowing unauthorized actions to be performed. The issue is exploited via the "/admin.php?p=/User/index" API endpoint. Recommendations For PbootCMS version 2.0....

CVE-2020-20971: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index...

p-nintendo.com Cross Site Scripting vulnerability OBB-2627700

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-44974

radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/binsymbols.c binary symbol parser...

GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic

A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...

PT-2022-37001

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type known as Memcpy-param-overlap. The crash state involves several functions, including repeat, p ere, and cli regcomp...

GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic

A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or P256.ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected...

PT-2022-20097

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /vloggers merch/?p=view product&id= endpoint, where the id parameter is vulnerable. No information is provided about...