PT-2024-15312 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to a missing permission check in the applyCustomDescription function of SaveUi.java, allowing potential local information disclosure with user execution privileges...

PT-2024-12854 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to a confused deputy in the applyCustomDescription function of SaveUi.java, allowing an attacker to view other users' images. This could lead to local information...

PT-2024-40452 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.33.1 Description: The issue arises when a node receives a block with a timestamp more than 15 seconds ahead of its local time, potentially leading to the block being marked as invalid and the peer being banned. T...

PT-2023-33065

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 0.14.x and 0.15.x Description A malicious client can exploit a issue by sending reliable-ordered packets in a way that causes all packets, except the first one, to stay in the reliable-ordered queue until the missin...

PT-2023-28579 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to the cookie session ID being of insufficient length, making it vulnerable to brute force attacks. This could allow a remote attacker to obtain a valid session, bypa...

PT-2023-27297 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to a cross-site scripting vulnerability, which could allow an attacker to access the web application and introduce arbitrary JavaScript by injecting an XSS payload in...

PT-2023-28893

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 7.10 Description The issue arises from the implementation of deriveVaultKey, which generates a vault key with the last 16 bytes predetermined to be "arfoobarfoobarfo". This occurs because deriveVaultKey calls...

PT-2023-27928 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2023.01.14.325 Description: The issue allows SQL Injection through the sort parameter of the "/index.php" endpoint. Recommendations: For versions prior to 2023.01.14.325, consider disabling the sort parameter in th...

PT-2023-20644 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to the integrated oAuth Authorization Service, where functions with insufficient randomness were used to generate authorization tokens. This made authorization codes...

PT-2023-36345

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 0.8.6 Description A bug was discovered that can be exploited by malicious server admins to crash clients or potentially execute arbitrary code, although no working exploit code is known to exist at this time...

PT-2023-22643 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions =2.0.44 Description: Reflected XSS affects the mode parameter in the "/admin" functionality of the web application. Recommendations: For versions =2.0.44, update to a version greater than 2.0.44 to resolve the issue. As a...

PT-2023-19295 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to v6 Description: An improper access control issue exists that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room. Recommendations: For versions prior t...

PT-2023-16504 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to an improper validation of array index. This could allow an attacker to crash the server and remotely execute arbitrary code. Recommendations: At the moment, there ...

PT-2022-12946 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this issue may affect data confidentiality. Recommendations: At the moment, there is n...

PT-2022-18122 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.6 Description: When using tasks to read config files, there is a risk of database password disclosure. Recommendations: For versions prior to 2.0.6, upgrade to version 2.0.6 or higher...

PT-2022-25628 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions 16.0.1 through 16.0.2 Description: SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent...

PT-2022-26046 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.1.1 Description: The issue allows for denial of service attacks due to the Unmarshal function panicking on certain inputs. Recommendations: For versions prior to 2.1.1, update to version 2.1.1 to resolve the issu...

PT-2022-28229 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.43.3 SoftwareX versions 0.43.3 through 0.99 Description: The issue arises when a transaction contains a dep group with many cells, resulting in resources required to process it not being linear to the transaction...

PT-2022-26448 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.0-M9 Description: The issue allows an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. This enables the end-user ...

PT-2022-28257 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.2.1 Description: The issue is related to the default cookie name prefix, which was set to Host instead of Host-. This prefix is used for additional security to ensure the cookie came from the correct domain when ...