96 matches found
caldera-crater
Crater Crater è il Caldera Rat. Si trova nella cartella crater/. Compilazione Crater richiede Mono 64 bit per essere compilato. Una volta installato Mono, Crater viene compilato eseguendo buildall.bat...
CVE-2026-57863
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863
Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...
EUVD-2026-65478
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
Crater-CVE-2023-46865-RCE
Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Schwachstellenbeschreibung Crater Invoice ist anfällig für uneingeschränkte Datei-Uploads mit gefährlichem Typ aufgrund fehlender ordnungsgemäßer Eingabevalidierung. Die Base64Mime-Prüfklasse kann umgangen werden,...
CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...
CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...
CVE-2026-55739 Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion
Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...
CVE-2026-14791 crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...
CVE-2026-14791
CVE-2026-14791 affects crater-invoice-inc crater up to 6.0.6. The vulnerability exists in the function getFormattedString of app/Http/Requests/InvoicesRequest.php within the Invoice Note Handler . Manipulating the argument notes may lead to cross-site scripting (XSS) . The attack can be launched ...
EUVD-2026-41802
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...
CVE-2022-0515
Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...
CVE-2022-0242
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...
CVE-2022-0372
Cross-site Scripting XSS - Stored in Packagist bytefury/crater prior to 6.0.2...
EUVD-2022-15643
Malicious code in bioql PyPI...
EUVD-2022-0489
Malicious code in bioql PyPI...
EUVD-2022-15642
Malicious code in bioql PyPI...