PT-2024-4391

Name of the Vulnerable Software and Affected Versions Net::CIDR::Lite versions prior to 0.22 Description The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string. This can allow attackers to bypass access control based on IP addresses in...

Server Side Request Forgery (SSRF)

ip is vulnerable to Server Side Request Forgery. The vulnerability is due to the isPublic function's failure to interpret and classify hexadecimal IP address representations. If an application utilizes the isPublic or isPrivate functions to determine if an address is public, an attacker can prefo...

CVE-2024-0685 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter...

PT-2023-29870 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.8.0 Description: The issue concerns the default email address for the initial admin user, which is set to [email protected]. This could potentially affect password reset functionality if the domain mycompany.c...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

The vulnerability of the de265_image::set_SliceAddrRS(int, int, int) function in the implementation of the h.265 Libde265 codec allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the de265image::setSliceAddrRSint, int, int function in the h.265 video codec Libde265 is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

If frontend == address(0), 10% of the ticket price is not used as intended

Lines of code Vulnerability details Impact The function buyTickets, has no check that frontend is not equal to zero address. This is possible if there was some misconfiguration from the frontend side or a player uses this function directly and does not set any address. In this case, the user...

Huawei EulerOS: Security Advisory for python-pip (EulerOS-SA-2023-1152)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CSCMS Music Portal System SQL注入漏洞

CSCMS Music Portal System is a diversified content management system from China Sunshine Network Technology CSCMS, Inc. A SQL injection vulnerability exists in CSCMS Music Portal System, which originates from the missing validation of the id parameter at /admin.php/pic/admin/pic/del for external...

GHSA-HGR8-G756-VMG9 Zeta Components Mail Arbitrary code execution via a crafted email address

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one...

The vulnerability in the implementation of the oal_wan6_setIpAddr() function in the libcmm.so module of the TP-Link TL-WR840N (ES) router’s software allows a attacker to execute arbitrary code.

The vulnerability in the implementation of the oalwan6setIpAddr function in the libcmm.so module of the TP-Link TL-WR840N ES router’s software lies in the failure to properly handle special elements when processing the XTPExternalIPv6Address argument. Exploiting this vulnerability allows an...

CVE-2021-22434

There is a memory address out of bounds vulnerability in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed...

CVE-2021-45977

CVE-2021-45977 affects JetBrains IDEs used as Remote Development backends where the affected products bound to the 0.0.0.0 address. The vulnerability description from connected sources notes exposure of the backend service due to binding to an all interfaces address. Fixed versions are provided: ...

Design/Logic Flaw

An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dumpodtosaf.isra function, which causes a segmentation fault and application crash...

CVE-2021-44920

An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dumpodtosaf.isra function, which causes a segmentation fault and application crash...

CVE-2021-44920

An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dumpodtosaf.isra function, which causes a segmentation fault and application crash...

Signature check passes for maker=0 orders

Handle cmichel Vulnerability details It's possible to choose the zero address for the maker of an order. Then any signature will pass the validOrderHash check. Impact This doesn't lead to any serious issues as the zero address does not have any approvals set of its own. The transactions will fail...

PT-2021-15051 · Huawei · Emui +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves a memory address out of bounds in smartphones, which could potentially allow malicious code to be executed upon successful...

Security update for postsrsd (moderate)

openSUSE Security Update: Security update for postsrsd Announcement ID: openSUSE-SU-2021:0669-1 Rating: moderate References: 1180251 Cross-References: CVE-2020-35573 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available. Description: This update...

Warning Issued Over Hackable ADT's LifeShield Home Security Cameras

Newly discovered security vulnerabilities in ADT's Blue formerly LifeShield home security cameras could have been exploited to hijack both audio and video streams. The vulnerabilities tracked as CVE-2020-8101 were identified in the video doorbell camera by Bitdefender researchers in February 2020...