CVE-2022-40036

An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserList component...

PT-2023-13744 · Rawchen · Rawchen Blog-Ssm

Name of the Vulnerable Software and Affected Versions: Rawchen blog-ssm version 1.0 Description: An issue was discovered that allows an attacker to obtain sensitive user information by bypassing permission checks via the "adminGetUserList" component, specifically through the "/adminGetUserList" A...

Inout Search Engine 10.1.3 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2022-45542

EyouCMS = 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file...

Cross site scripting

EyouCMS = 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file...

Cross site scripting

EyouCMS = 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file...

PT-2023-9444 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a null pointer dereference in the gsmi component of the Linux kernel. This can be triggered by a new get variable call with attr=NULL, which was introduced by a...

CVE-2022-45539

EyouCMS = 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file...

Cross-Site Request Forgery (CSRF)

apache-superset is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the use of the HTTP GET method for the legacy REST API endpoints in the requestaccess and approve functions of core.py, allowing an attacker to redirect to the malicious URL through the GET request...

Regular Expression Denial of Service (ReDoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

PT-2023-10623 · Unknown · Ridhoq Soundslike

Name of the Vulnerable Software and Affected Versions: ridhoq soundslike affected versions not specified Description: A critical issue was found in ridhoq soundslike, affecting the get song relations function of the file app/api/songs.py. This issue leads to sql injection. Recommendations: Apply ...

The vulnerability of the software implementation of the SNMP protocol for the Cisco Firepower Management Center (FMC) allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SNMP protocol-based software for managing Cisco Firepower Management Centers involves deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information by sending GET requests...

GSD-2023-1001379 i2c: mux: reg: check return value after calling platform_get_resource()

i2c: mux: reg: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

PT-2023-33471 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.18 Description: The issue concerns an error code return to user-space in the ext4 get branch function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-33167 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue concerns a possible out-of-bounds oob access in the ieee80211 get rate duration function. This is related to the wifi mac80211 component. The actual impact and attack plausibility...

UBUNTU-CVE-2022-47630

Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of getext and authnvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state...

get-deal.com Cross Site Scripting vulnerability OBB-3155993

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

NethServer nethserver-phonenehome SQL注入漏洞

nethserver-phonenehome is an open source application for NethServer. It is used to track all NethServer installations worldwide. NethServer nethserver-phonenehome suffers from a SQL injection vulnerability that originates from a security issue in the function getinfo/getcountrycoor in the file...

PT-2023-12417 · Unknown · Nethserver

Name of the Vulnerable Software and Affected Versions: NethServer phonenehome affected versions not specified Description: A critical issue affects the function get info/get country coor of the file server/index.php, leading to sql injection. Recommendations: Apply a patch to fix this issue. As a...

PT-2023-14667

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 Description The system allowed an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint when the feature flag DASHBOARD CACHE was...