EUVD-2023-48119

Malicious code in bioql PyPI...

EUVD-2023-55496

Malicious code in bioql PyPI...

EUVD-2023-52485

Malicious code in bioql PyPI...

CVE-2023-50867

Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database...

Sql injection

Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-52081

ffcss (the Firefox CSS themes CLI) before version 0.2.0 contains a vulnerability in lookupPreprocess() where late Unicode normalization (NFKD) can bypass the intended regex filter and reintroduce characters like _ and ., allowing relaxed theme searches. The security impact is described as low and...

CVE-2023-52081 ewen-lbh/ffcss late-Unicode normalization vulnerability

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...

Sql injection

Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'classid' parameter of the addclasses.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-45347

CVE-2023-45347 affects Online Food Ordering System v1.0. The vulnerability is due to unauthenticated SQL Injection in the *_verified parameter of routers/user-router.php where input is not validated before reaching the database. Multiple Red Hat and NVD records confirm the issue; exploitation sta...

CVE-2023-45341 Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-28635 Defining resource name as integer in vantage6 may give unintended access

vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to...

CVE-2023-44166

The CVE concerns Projectworlds Online Movie Ticket Booking System v1.0, where the age parameter of process_registration.php does not validate input and sends characters unfiltered to the database, enabling SQL injection. Reported details indicate a high-severity impact affecting confidentiality, ...

CVE-2023-44165

CVE-2023-44165 entry is rejected and does not represent an active vulnerability.

CVE-2023-44164

CVE-2023-44164 involves the Email parameter of process_login.php in Online Movie Ticket Booking System v1.0. The input is not validated and is sent unfiltered to the database, described as an unauthenticated SQL injection risk in multiple sources. Affected product details indicate Projectworlds O...

fast-xml-parser regex vulnerability patch could be improved from a safety perspective

Summary This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it. Details The code which validates a name calls the validator:...

CVE-2014-2243

includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timin...