Crossplane-runtime contains Improper Input Validation via Compositions

Summary Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the fieldpath package from crossplane/crossplane-runtime that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplan...

CVE-2023-1300

A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...

CVE-2023-1300

CVE-2023-1300 affects SourceCodester COVID 19 Testing Management System 1.0 in the file patient-report.php (POST Parameter Handler). The vulnerability is an SQL injection triggered by manipulating the searchdata parameter, exploitable remotely and publicly disclosed. Evidence from multiple source...

CVE-2023-1300 SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injection

A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...

CVE-2023-25814

metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the...

CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

Improper access control

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25814

Vulnerability overview (CVE-2023-25814) : metersphere prior to 2.7.1 allows a user with UI-created resource file permission to append a path to their submission query, which is then read and displayed by the system, enabling read access to arbitrary server filesystem files if the server process h...

CVE-2023-25573

Metersphere contains an improper access control vulnerability: unauthenticated users can download arbitrary files via /api/jmeter/download/files, exposing sensitive data. Affected versions include those prior to the fixes, with remediation in versions 1.20.20 lts and 2.7.1. The issue stems from i...

CVE-2023-1300: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...

Sourcecodester COVID 19 Testing Management System SQL注入漏洞

Sourcecodester COVID 19 Testing Management System is a web-based application that provides an online platform for personal and Covid test administration to manage individual testing processes and results. A SQL injection vulnerability exists in SourceCodester COVID 19 Testing Management System...

PT-2023-16872 · Sourcecodester · Sourcecodester Covid 19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A critical issue was found in the COVID 19 Testing Management System, affecting an unknown functionality of the patient-report.php file, specifically in the POST...

The US Air Force Is Moving Fast on AI-Piloted Fighter Jets

After successful autonomous flight tests in December, the military is ramping up its plans to bring artificial intelligence to the skies...

Debian: Security Advisory (DSA-2104-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

This Week in Spring - March 7th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's an amazing week, and this week we've got a lot to look at. Let's dive right into it. Spring Cloud Function for Azure Function Spring Data 2022.0.3 and 2021.2.9 released Spring R2DBC for Reactive Relational Databases in...

CVE-2022-3857

Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested...

Purchase Order Management 1.0 Cross Site Scripting

Title: Purchase Order Management-1.0 - XSS-Reflected - Information-gathering Author: nu11secur1ty Date: 03.06.2023 Vendor: https://www.sourcecodester.com/user/257130/activity Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html...

Exploit for Double Free in Linux Linux_Kernel

This is a repository containing a proof-of-concept PoC exploit for a vulnerability in a Linux kernel module. The PoC is for CVE-2021-22600, a vulnerability in the Linux kernel's packet socket implementation that allows an attacker to bypass certain security restrictions. The exploit is implemente...

The vulnerability of the System Management Unit (SMU) component of AMD processors allows a hacker to trigger a service failure.

The vulnerability of the System Management Unit SMU component of AMD processors exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

DNA testing service to pay $400k for data breach it ignored

By Habiba Rashid DNA Diagnostics Center DDC, a US-based DNA testing service suffered a data breach in November 2021, in which… This is a post from HackRead.com Read the original post: DNA testing service to pay $400k for data breach it ignored...