PT-2023-25524 · Phpjabbers · Phpjabbers Document Creator

Name of the Vulnerable Software and Affected Versions: PHPJabbers Document Creator version 1.0 Description: There is a Cross Site Scripting XSS issue in the action parameter of "index.php" in PHPJabbers Document Creator. This allows for potential malicious script execution. Recommendations: For...

CVE-2023-36310

Summary (CVE-2023-36310): A cross-site scripting (XSS) vulnerability exists in PHPJabbers Document Creator v1.0, specifically in the column parameter of index.php. The root cause is unvalidated input in the column parameter leading to script execution. The NVD entry rates it as CVSS v3.1 base sco...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. An attacker can exploit this vulnerability to obtain the email address of the pipeline creator by injecting malicious code into the email address field...

Whitelisted profile creators could accidentally break migration for V1 profiles

Lines of code Vulnerability details Bug Description Profiles that exist before the V2 upgrade are migrated using the batchMigrateProfiles function, which works by minting the profile's handle and linking it to their profile: MigrationLib.solL69-L85 string memory handle =...

SUSE CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

WordPress Bulk WooCommerce Category Creator Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Bulk WooCommerce Category Creator Type Plugin Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 857dc229de57 Credits Rafie Muhammad...

WordPress Mass Pages/Posts Creator Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Mass Pages/Posts Creator Type Plugin Vulnerable versions = 2.1.6 Fixed in 2.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e259a062e790 Credits Rafie Muhammad Patchsta...

Stealing excess tokens from other users by either front-running skim function or calling it before legitimate user

Lines of code Vulnerability details Impact File /src/interfaces/IWell.sol comment's defines what the skim function is being responsible for: / @notice Sends excess tokens held by the Well to the recipient. @param recipient The address to send the tokens @return skimAmounts The amount of each toke...

It is possible to override pool params in PoolRegistry.sol since the creator field is never set for a venus pool

Lines of code Vulnerability details Proof of Concept PoolRegistry.createPoolRegistry will call PoolRegistry.registerPool which will make a check on the creator field for a pool. VenusPool memory venusPool = poolByComptrollercomptroller; requirevenusPool.creator == address0, "PoolRegistry: Pool...

Attacker can DoS create a extraordinary proposals

Lines of code Vulnerability details Impact An attacker can prevent the creation of proposals in ExtraordinaryFunding.solproposeExtraordinary by front-running the proposal, which will give him the same hash as the correct user desired, and setting endBlock to the past, which will invalidate the...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. XWiki Platform suffers from a cross-site scripting vulnerability that originates from the fact that any user who can create a space can become the administrator of that space in ...

Contributors wouldn't claim their party cards from the finalized ReraiseETHCrowdfund by a malicious crowdfund creator.

Lines of code Vulnerability details Impact With the custom min/maxContributions settings, contributors wouldn't claim their part cards after the ReraiseETHCrowdfund was finalized. As a result, their funds will be locked inside the party forever because they can't claim from TokenDistributor witho...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

Tippa My Tongue Tippa My Tongue is an exploit that uses CVE-2...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop advancedpopupcreator versions v1.1.21...

PT-2023-20908 · Prestashop · Prestashop Advancedpopupcreator

Name of the Vulnerable Software and Affected Versions: Prestashop advancedpopupcreator versions 1.1.21 through 1.1.24 Description: The issue is related to a SQL injection vulnerability. It affects the component AdvancedPopup::getPopups. Recommendations: For versions 1.1.21 through 1.1.24, conside...

The vulnerability of the Screen Creator Advance 2 software lies in the execution of operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Screen Creator Advance 2 software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

CVE-2023-25755

Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer CWE-119 due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project...

CVE-2023-25755

CVE-2023-25755 affects Screen Creator Advance 2 (versions 0.1.1.4 Build01A and earlier). The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119) due to an inadequate data size check when processing a project file. Impact stated across sources includes i...

CVE-2023-25755

Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer CWE-119 due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project...

CVE-2023-25755

Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer CWE-119 due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project...