Online Food Ordering System SQL Injection Vulnerability

Online Food Ordering System is an online food ordering system by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Online Food Ordering System v1.0, which is caused by insufficient filtering of the phone parameter on the routers/details-router.php page...

ASB-A-259064622

In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-30171 · Unknown · Lte-Pic32-Writer

Name of the Vulnerable Software and Affected Versions: lte-pic32-writer versions 0.0.1 and prior Description: The issue affects users of sendto.txt and allows attackers who know the IMEI to read the sendto.txt file, which may contain sensitive information such as SNS URLs and API keys...

CVE-2023-21394

In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21364

In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

Code injection

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

Design/Logic Flaw

In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365

CVE-2023-21365 affects Android’s Phone app, where the Contacts component can enter a crash loop due to resource exhaustion. This leads to a local denial of service with User privileges required and no user interaction needed. Public details from the provided sources confirm the DoS impact and loc...

CVE-2023-21364

In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21364

In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18140 · Phone App · Phone App

Name of the Vulnerable Software and Affected Versions: Phone app affected versions not specified Description: The issue is related to a possible crash loop due to resource exhaustion in the Contacts component of the Phone app. This could lead to a local denial of service. User execution privilege...

WordPress Login with Phone Number Plugin Code Execution

The vulnerability of the lwpforgotpassword function in the “Login with Phone Number” plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

CVE-2023-21364: Undefined Security Weakness

In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21365: Undefined Security Weakness

In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-5051

CVE-2023-5051 affects CallRail Phone Call Tracking for WordPress. It is a Stored XSS via the callrail_form shortcode in versions ≤ 0.5.2 due to insufficient input sanitization and output escaping on the form_id attribute. Authenticated attackers with contributor+ permissions can inject scripts ex...

WordPress plugin CallRail Phone Call Tracking Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...