PT-2022-24823 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.15 Parse Server versions 5.0.0 through 5.2.5 Description: A user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to...

Authentication flaw

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP reque...

in aquilacms/aquilacms

✍️ Description Unauthenticated API function allows any user to change OR view another user first name, last name, password, and address information. As well, leaked activateAccountToken and resetPassToken can be viewed. 🕵️‍♂️ Proof of Concept The attacker can guess the correct MongoDBobject ID and...

CVE-2020-13825

A cross-site scripting XSS vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter...

Denial of Service (DoS)

Overview bson is an a fully featured BSON specification implementation in Ruby. Affected versions of this package are vulnerable to Denial of Service DoS. The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby as used in rubygem-moped allows remote attackers to cause a denial of service work...

The vulnerability of the _asn1_expand_object_id function (p_tree) in the Libtasn1 library of the Debian GNU/Linux operating system, related to resource management errors, allows a perpetrator to cause a service failure.

The vulnerability of the asn1expandobjectid function in the Libtasn1 library for the Debian GNU/Linux operating system is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2019-11827

Cross-site scripting XSS vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the objectid parameter...

PT-2019-12512 · Synology · Note Station

Name of the Vulnerable Software and Affected Versions: Synology Note Station versions prior to 2.5.3-0863 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the object id parameter. Recommendations: For versions prior to 2.5.3-0863, update...

Schneider Electric U.Motion Builder track_import_export.php object_id unauthenticated command injection vulnerability

U.motion Builder is a builder product from Schneider Electric France. A security vulnerability exists in Schneider Electric U.Motion Builder trackimportexport.php objectid. The vulnerability is due to the application failing to properly validate and filter this parameter and can be exploited by a...

PT-2019-2664

Name of the Vulnerable Software and Affected Versions U.motion Builder version 1.3.4 Description A SQL Injection issue exists in the software, which could cause unwanted code execution when an improper set of characters is entered. The vulnerability is related to incorrect handling of special...

curl and nss-pem security and bug fix update

curl 7.29.0-51 - require a new enough version of nss-pem to avoid regression in yum 1610998 7.29.0-50 - remove dead code, detected by Coverity Analysis - remove unused variable, detected by GCC and Clang 7.29.0-49 - make curl --speed-limit work with TFTP 1584750 7.29.0-48 - fix RTSP bad headers...

UBUNTU-CVE-2018-1000654

GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in asn1expandobjectidptree, after a long time, the program will be killed. This attack appears to be exploitable via...

PT-2018-2898

Name of the Vulnerable Software and Affected Versions libtasn1 versions 4.12 through 4.13 Description The issue is related to a denial of service DoS in the asn1 expand object idp tree function, which can cause CPU usage to reach 100% when parsing a crafted file with the asn1Parser. This can lead...

CVE-2018-13860

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/menu/getObjectEditor.xml" URL, using a "?oid=systemSetup&id=0" or "?oid=systemUsers&id=0" GET...

CVE-2018-7765

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter...

CVE-2018-8914

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

PT-2018-1122

Name of the Vulnerable Software and Affected Versions Schneider Electric U.motion Builder software versions prior to v1.3.4 Description The issue exists in the processing of track import export.php, where the underlying SQLite database query is subject to SQL injection on the object id input...

Schneider Electric U.motion Builder track_import_export remote code execution vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder trackimportexport. When the export operation is selected in an applet call, the underlying SQLite database query requires SQL injection of the...

CVE-2016-6644

EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an robjectid value...

PT-2016-7017

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 4.5 before patch 15 EMC Documentum D2 versions 4.6 before patch 03 Description The issue allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r object id value. Recommendations Fo...