CVE-2024-10197

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /managesupplier.php of the component Manage Supplier Page. The manipulation of the argument address leads to cross site scripting. It is...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows a hacker to manipulate the content of a URL string

The vulnerability of Google Chrome’s Picture In Picture technology is related to the distortion of important information in the user interface. Exploiting this vulnerability can allow a malicious actor to manipulate the content of the URL string using a specially created HTML page...

Yoga Class Registration System 安全漏洞

Yoga Class Registration System is a yoga class registration system by the individual developer Carlo Montero. A security vulnerability exists in Yoga Class Registration System version 1.0, which stems from a cross-site scripting attack due to manipulation of parameter addresses...

AdTran SRG 834-5 HDC17600021F1 操作系统命令注入漏洞

The AdTran SRG 834-5 HDC17600021F1 is a Gigabit Ethernet gateway from Adtran USA. An operating system command injection vulnerability exists in AdTran SRG 834-5 HDC17600021F1 SmartOS version 11.1.1.1, which can be exploited to execute arbitrary operating system commands with root privileges by...

CVE-2024-5375 Kashipara College Management System submit_student.php cross site scripting

A vulnerability has been found in Kashipara College Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file submitstudent.php. The manipulation of the argument address leads to cross site scripting. The attack can be launched...

CVE-2024-5374 Kashipara College Management System submit_new_faculty.php cross site scripting

A vulnerability, which was classified as problematic, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file submitnewfaculty.php. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2023-5403

Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning...

Cross site scripting

A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Employer/EditProfile.php. The manipulation of the argument Address leads to cross site scripting. The attack may be launched remotely...

CVE-2024-1972

CVE-2024-1972 affects SourceCodester Online Job Portal 1.0. The issue is a cross-site scripting vulnerability in the /Employer/EditProfile.php functionality, triggered by manipulating the Address parameter. It is exploitable remotely and an exploit has been disclosed publicly. Impact is limited t...

SAP Fiori Security Breach

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. A security...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-5133

CVE-2023-5133 concerns the WordPress plugin User Activity Log Pro (prior to 2.3.4). Technical details across connected sources show that it retrieves client IP addresses from potentially untrusted headers, enabling an attacker to spoof/manipulate the IP value and thereby hide malicious activity. ...

PT-2023-31785 · WordPress · User Activity Log Pro

Name of the Vulnerable Software and Affected Versions: user-activity-log-pro WordPress plugin versions prior to 2.3.4 Description: The issue allows an attacker to manipulate the client IP address value by exploiting the plugin's retrieval of IP addresses from potentially untrusted headers. This c...

PT-2023-28584 · WordPress · User Activity Log

Name of the Vulnerable Software and Affected Versions: User Activity Log WordPress plugin versions prior to 1.6.7 Description: The issue allows an attacker to manipulate the client IP address value retrieved by the plugin, potentially hiding the source of malicious traffic. This is due to the...

CVE-2023-3259

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the...

Dataprobe Code Issue Vulnerability

Dataprobe is a line of intelligent power switches and management products from Dataprobe, Inc. in the United States. A security vulnerability exists in Dataprobe iBoot PDU version 1.43.03312023 and earlier versions. The vulnerability stems from the presence of deserialization of untrusted data in...

When deploying contracts in PermissionedNodeRegistry.deployWithdrawVault(), PermissionlessNodeRegistry.deployWithdrawVault(), an attacker can find out in advance the address of the future deployed contract and deploy his own at this address

Lines of code Vulnerability details Impact The address of the new contract depends solely on the salt parameter, which is calculated from user-provided data. Once a user's create transaction is broadcast, the parameters for calculating salt can be viewed by anyone viewing the public mempool. This...

CVE-2023-0865

The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to...

WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR

The plugin does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. PoC R...

SUSE CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...