PT-2023-23431 · Fuxa · Fuxa

Name of the Vulnerable Software and Affected Versions: FUXA versions 1.1.12 and earlier Description: The issue allows for Local File Inclusion via the "/api/download" API endpoint. This could potentially be exploited to access sensitive files on the system. Recommendations: For versions 1.1.12 an...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android due to an insecure PendingIntent in the createQuickShareAction of SaveImageInBackgroundTask.java, which can be exploited by an attacker to elevate privileges...

PT-2023-22928 · Unknown · Gamelauncher

Name of the Vulnerable Software and Affected Versions: GameLauncher versions prior to 4.2.59.5 Description: The issue allows local attackers to access data through a PendingIntent hijacking vulnerability. Recommendations: For versions prior to 4.2.59.5, update to version 4.2.59.5 or later to...

PT-2023-27665 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue concerns a command execution vulnerability in the sub ADF3C function. This vulnerability is exploited through the formSetIptv function, which obtains the list a...

PT-2023-8337 · Unknown · Smartnode Sn200

Name of the Vulnerable Software and Affected Versions: SmartNode SN200 aka SN200 version 3.21.2-23021 Description: The issue is related to the Network Diagnostic Commands function of the SmartNode SN200 analog telephone adapter's firmware, which fails to neutralize special elements used in an...

CVE-2023-21229

In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18014 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: In the registerServiceLocked function of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent. This could lead to...

CVE-2023-30701

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

Missing deadline param in swapExactAmountOut() allowing outdated slippage and allow pending transaction to be executed unexpectedly.

Lines of code Vulnerability details Impact Loss of funds/tokens for the protocol, since block execution is delegated to the block validator without a hard deadline. Proof of Concept The function swapExactAmountOut from LiquidationRouter.sol and LiquidationPair.sol use these methods to swap tokens...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper view permissions which allows an attacker to see pending invitations of any public group or public project by visiting an API endpoint...

Rudder Server SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rudder Server SQLI Remote Code Execution', 'Description' = %q This Metasploit module exploits a SQL injection vulnerability in RudderStack's...

PT-2023-25687 · 3S Smart Software Solutions · Codesys Development System +1

Name of the Vulnerable Software and Affected Versions: CODESYS Development System versions 3.5.9.0 through 3.5.17.0 CODESYS Scripting versions 4.0.0.0 through 4.1.0.0 Description: The issue is related to unsafe directory permissions in the affected software. This could allow an attacker with loca...

PT-2023-26247 · Unknown · Chengdu Flash Flood Disaster Monitoring/Warning System

Name of the Vulnerable Software and Affected Versions: Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0 Description: A vulnerability was found in the Chengdu Flash Flood Disaster Monitoring and Warning System. It affects some unknown functionality of the file...

newer tx can remain un approved due nto previous tx not passing

Lines of code Vulnerability details Impact Newer transaction will not get approved because previous on es have not been approved or rejected Proof of Concept Let's say two out of 3 addresses sign a transaction which requires 3 signers then after some time the 3 now sign another transaction it won...

PT-2023-6541 · Icewarp · Icewarp

Name of the Vulnerable Software and Affected Versions: IceWarp version 10.2.1 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the color parameter, allowing a remote attacker to conduct cross-site scripting attacks...

Wedding Wonders 1.0 Cross Site Scripting

Exploit Title: Wedding Wonders 1.0 - Stored XSS Exploit Author: CraCkEr Date: 13/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/wedding-wonders-a-matrimonial-and-matchmaking-platform/17 Tested on: Windows 10 Pro Impact: Manipulate t...

EX-RATE 1.0 Cross Site Scripting

Exploit Title: EX-RATE 1.0 - Stored XSS Exploit Author: CraCkEr Date: 14/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/ex-rate-a-complete-money-exchange-solution/14 Tested on: Windows 10 Pro Impact: Manipulate the content of the si...

Pending owner can be the wrong recipient of ownership

Lines of code Vulnerability details Impact An attacker can call the acceptOwnership function with their address as the pending owner before the legitimate pending owner has a chance to call the function Proof of Concept The transferOwnership function allows the current owner to set a pending owne...

Arbitrary Pending _setPendingVetoer Address Assignment.

Lines of code Vulnerability details Impact If an attacker successfully impersonates the vetoer, they can set any address as the pending vetoer. This can compromise the integrity of the vetoer role and enable unauthorized access or control over certain functions or actions within the contract. Pro...

WordPress Plugin Galleria 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...