com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

A flaw was found in gson, which is vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes. This issue may lead to availability attacks...

com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson

A flaw was found in gson, which is vulnerable to Deserialization of Untrusted Data via the writeReplace method in internal classes. This issue may lead to availability attacks...

markdown-it-decorate vulnerable to cross-site scripting (XSS)

markdown-it-decorate adds attributes, IDs and classes to Markdown, and the most recent version 1.2.2 was published in 2017. All versions are currently vulnerable to cross-site scripting XSS and there is no fixed version at this time...

CVE-2022-35904

An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within...

PT-2022-21225

Name of the Vulnerable Software and Affected Versions Fast Food Ordering System version 1.0 Description The issue is related to a persistent cross-site scripting XSS vulnerability. This vulnerability is present in the /ffos/classes/Master.php?f=save category component. Recommendations For Fast Fo...

CVE-2022-32318: Improper Neutralization of Input During Web Page Generation

Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting XSS vulnerability via the component /ffos/classes/Master.php?f=savecategory...

CVE-2022-32416: Improper Neutralization of Special Elements used in an SQL Command

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=deleteproduct...

PT-2022-21310

Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue is related to SQL Injection via the /psrs/classes/Master.php?f=delete product API endpoint. This allows for potential manipulation of database queries. No information is provided about t...

Possible RCE escalation bug with Serialized Columns in Active Record

There is a possible escalation to RCE when using YAML serialized columns in Active Record. This vulnerability has been assigned the CVE identifier CVE-2022-32224. Versions Affected: All. Not affected: None Fixed Versions: 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1 Impact ------ When serialized columns th...

manchesterdanceclasses.co.uk Cross Site Scripting vulnerability OBB-2751921

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

h2: Loading of custom classes from remote servers through JNDI

A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...

Remote Code Execution

ldap-account-manager is vulnerable to remote code execution. An attacker is able to inject the first constructor argument leading to code execution if non-LAM classes are instantiated during object creation...

CVE-2022-32310: Incorrect Authorization

An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php...

PT-2022-21673

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete schedule" endpoint. Recommendations...

CVE-2022-33058: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletemessage...

PT-2022-21672

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/classes/Master.php?f=delete train" endpoint. Recommendations For Online Railway...

PT-2022-21670

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description A SQL injection issue was found in the Online Railway Reservation System. The vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete reservation"...

PT-2022-21674

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete service" API endpoint. Recommendatio...

CVE-2022-33057: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletereservation...

CVE-2022-33059: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletetrain...