Exploit for Cross-site Scripting in Angtech Haraj

CVE-2022-31300 Haraj Script 3.7 - DM Section Authenticated Sto...

CVE-2022-2062

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+...

Generation of Error Message Containing Sensitive Information

Description The software generates an error message that includes sensitive information about its environment, users, or associated data. Proof of Concept 1. The forgot password feature will tell you whether or not a username exists which is a vulnerability since it can be paired with the lack of...

Vapor Denial of Service Vulnerability

Vapor is a Swift web development framework. Can be used to develop high-performance Web applications , support for iOS, OS X and Ubuntu systems. A denial-of-service vulnerability exists in Vapor versions prior to 4.61.1 that stems from not properly handling incoming error messages and can be...

PT-2022-14828 · Nocodb · Nocodb

Name of the Vulnerable Software and Affected Versions: NocoDB versions prior to 0.91.7 Description: The issue concerns the generation of error messages containing sensitive information and the lack of verification or validation in the SMTP plugin. This allows attackers to make requests to interna...

IDOR in Messages function

Description An user can view other users' private messages, join the conversation, delete messages if they know messages uuid Proof of Concept 1. A send B a priavte messages/email 2. C can view messages, join the conversation, delete messages if C know messages uuid...

EGavilan Media Contact-Form-With-Messages-Entry-Management SQL Injection Vulnerability

EGavilan Media Contact-Form-With-Messages-Entry-Management is a simple contact form system from EGavilan Media. EGavilan Media Contact-Form-With-Messages-Entry -Management version 1.0 contains a SQL injection vulnerability that stems from vulnerability to SQL injection attacks via Addmessage.php....

Mitsubishi Electric Air Conditioning System 加密问题漏洞

Mitsubishi Electric Air Conditioning System is an air conditioning management system from Mitsubishi Electric, a Japanese company. A security vulnerability exists in the Mitsubishi Electric Air Conditioning System. An unauthenticated, remote attacker could cause the air conditioning system's...

WordPress plugin WPQA Builder 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An access control error vulnerabili...

CVE-2022-30716

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device...

CVE-2022-30716

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device...

BigBlueButton Information Disclosure Vulnerability (CNVD-2022-82638)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an information disclosure vulnerability that stems from the lack of information protection measures and access controls for service meeting announcement chat messages.An attacker...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google, Inc. A buffer overflow vulnerability exists in Google Android, which stems from the fact that the UE and EMM use NAS messages to communicate with each other. The vulnerability can be exploited to remotely crash the modem...

The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows allows a hacker to perform spoofing attacks due to improper data analysis of XML messages in XMPP messages.

The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows is related to improper analysis of XML data in XMPP messages. Exploiting this vulnerability allows a malicious actor to perform a spoofing...

rsyslog: Heap-based overflow in TCP syslog server

A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code...

Automattic: Unauthenticated Private Messages DIsclosure via wordpress Rest API

Vulnearble Plugin: Senei LMS Hi there, Hope you are doing well, So, i noticed that their is an option to contact teacher on Sensei LMS which is meant to private. By default, other user can't see the question I asked to the teacher. But using the /wp-json/wp/v2/sensei-messages/ where numeric ID ca...

Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird displays all spaces. This flaw allows an attacker to send an ema...

Mozilla: Uninitialized variable leads to invalid memory read

The Mozilla Foundation Security Advisory describes this flaw as: A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption...

CVE-2022-31023

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by...

CVE-2022-31023 Dev error stack trace leaking into prod in Play Framework

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by...