Upgraded Q -> M from #404 [1674736594739]

Judge has assessed an item in Issue 404 as M risk. The relevant finding follows: L‑04 latestAnswer is deprecated Use latestRoundData instead so that you can tell whether the answer is stale or not. The latestAnswer function returns zero if it is unable to fetch data, which may be the case if...

Upgraded Q -> M from #658 [1674423084300]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-04 USDT IS NOT SUPPORTED FOR CALLING Trading.handleDeposit FUNCTION ON ETHEREUM MAINNET As shown by , USDT on the Ethereum mainnet does not allow approving a new amount when the existing approved amount is not zero...

PT-2023-18856 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 2.2-rev0-gab012bbfb-master Description: The issue is related to an integer overflow vulnerability in the Q DecCoordOnUnitSphere function, located in the bifs/unquantize.c file. This vulnerability can be exploited, but details abo...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

CVE-2022-46888: Improper Neutralization of Input During Web Page Generation

Multiple reflective cross-site scripting XSS vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q paramete...

q-bar-dueren.de Cross Site Scripting vulnerability OBB-3159144

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-34636

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description A potential issue exists where the q vector is not properly freed unless a new one is allocated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2023-34414

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A potential issue exists where the q vector is not properly freed unless a new one is allocated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

Cross site scripting

A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned ...

CVE-2023-0327

A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned ...

saemorris TheRadSystem 跨站脚本漏洞

TheRadSystem is a Cmput 391 project by saemorris Individual Developer. A cross-site scripting vulnerability exists in saemorris TheRadSystem, which stems from a problem with an unknown function in the file users.php, which can be exploited by an attacker to manipulate the parameter q to cause...

PT-2023-16181 · Unknown · Theradsystem

Name of the Vulnerable Software and Affected Versions: saemorris TheRadSystem affected versions not specified Description: A problematic issue has been identified, affecting an unknown function of the file users.php. The manipulation of the q argument leads to cross-site scripting. This issue can...

CVE-2023-0327: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned ...

Upgraded Q -> M from #172 [1673039408650]

Judge has assessed an item in Issue 172 as M risk. The relevant finding follows: L-02 --- The text was updated successfully, but these errors were encountered: All reactions...

Code injection

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/codecallercontroller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code injection. The exploit has...

CVE-2015-10009

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/codecallercontroller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code injection. The exploit has...

PT-2023-10188 · Unknown · Interchange

Name of the Vulnerable Software and Affected Versions: nterchange versions up to 4.1.0 Description: A critical issue affects the function getContent of the file app/controllers/code caller controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code...

CVE-2015-10009: Improper Control of Generation of Code

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/codecallercontroller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code injection. The exploit has...

PT-2022-11671 · Unknown · Studygolang

Name of the Vulnerable Software and Affected Versions: studygolang affected versions not specified Description: A problematic vulnerability was found in studygolang, affecting the Search function of the file http/controller/search.go. The manipulation of the argument q leads to cross-site...

CVE-2021-4273: Improper Neutralization

A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the...