PT-2022-8062 · Unknown · Catalyst-Plugin-Session

Name of the Vulnerable Software and Affected Versions: Catalyst-Plugin-Session versions up to 0.40 Description: A vulnerability has been found in the function load sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads ...

PT-2022-11741 · Openmrs · Openmrs Admin Ui Module

Name of the Vulnerable Software and Affected Versions: OpenMRS Admin UI Module versions up to 1.5.x Description: A vulnerability was found in the OpenMRS Admin UI Module, affecting unknown code of the file location.gsp. The manipulation leads to cross-site scripting. The attack can be initiated...

PT-2022-9029 · Openmrs · Openmrs Appointment Scheduling Module

Name of the Vulnerable Software and Affected Versions: OpenMRS Appointment Scheduling Module versions up to 1.12.x Description: A problematic issue has been found, affecting the validateFieldName function of the AppointmentTypeValidator.java file. This leads to cross-site scripting and can be...

PT-2022-28063 · Unknown · Json-Pointer

Name of the Vulnerable Software and Affected Versions: json-pointer versions up to 0.6.1 Description: A critical issue has been found in the function set of the file index.js, leading to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. This...

PT-2022-11692 · Unknown · Starcounter-Jack Json-Patch

Name of the Vulnerable Software and Affected Versions: Starcounter-Jack JSON-Patch versions up to 3.1.0 Description: A vulnerability has been found in Starcounter-Jack JSON-Patch, classified as problematic. This issue affects unknown code and leads to improperly controlled modification of object...

UBUNTU-CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

Stored XSS while adding a memo

Description Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. Proof of Concept Payload: " 1 Go to https://demo.usememos.com/ and login...

PT-2022-27842 · Ep3-Bs · Ep3-Bs

Name of the Vulnerable Software and Affected Versions: ep3-bs versions up to 1.7.x ep3-bs version 1.8.0 Description: A vulnerability has been found in ep3-bs, affecting an unknown part, which leads to cross site scripting. The manipulation can be initiated remotely. Recommendations: For ep3-bs...

Upgraded Q -> M from #4 [1671527898955]

Judge has assessed an item in Issue 4 as M risk. The relevant finding follows: GroupBuy.contribute does not set pendingBalances for unused capital, leading to locked up money --- The text was updated successfully, but these errors were encountered: All reactions...

buyQuote should be rounded up

Lines of code Vulnerability details Impact The buyQuote is not rounded up, which can cause a leak of value, due to the buyQuote being underestimated. Proof of Concept The function Pair.buyQuote does not round up, which can cause the issue described under Impact: function buyQuoteuint256...

PT-2022-27428 · Wso2 · Wso2 Carbon-Registry

Name of the Vulnerable Software and Affected Versions: WSO2 carbon-registry versions up to 4.8.11 Description: A vulnerability was found in the Advanced Search component of WSO2 carbon-registry, affecting some unknown functionality of the file...

PT-2022-27450 · Unknown · Sleepdata.Org

Name of the Vulnerable Software and Affected Versions: National Sleep Research Resource sleepdata.org versions up to 59.0.0.rc Description: A vulnerability has been found in the National Sleep Research Resource sleepdata.org, which is classified as problematic. The manipulation of an unknown...

PT-2022-27349 · Unknown · Collective.Dms.Basecontent

Name of the Vulnerable Software and Affected Versions: collective.dms.basecontent versions up to 1.6 Description: The issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py, leading to cross site scripting. The attack may be initiated remotely...

Privilege Escalation

github.com/aws/amazon-cloudwatch-agent is vulnerable to privilege escalation. The vulnerability exists when a user triggers a repair of the Agent which results in a pop-up window opening with SYSTEM permissions on Windows, allowing an attacker with administrative access to create a new command...

PT-2022-8295 · Pacparser +1 · Pacparser +1

Name of the Vulnerable Software and Affected Versions: pacparser versions up to 1.3.x Description: A problematic vulnerability was found in pacparser, affecting the pacparser find proxy function of the file src/pacparser.c. The manipulation of the url argument leads to buffer overflow. This issue...

CVE-2022-38395

HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up...

CVE-2022-38395

HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up...

HP Support Assistant 代码问题漏洞

HP Support Assistant is a suite of solutions from Hewlett-Packard HP in the United States that provides support and other features for PCs and printers. A security vulnerability exists in HP Support Assistant that stems from the use of HP Performance Tune-up as a diagnostic tool, HP Support...

PT-2022-16042 · Amazon · Amazon Cloudwatch Agent For Windows

Name of the Vulnerable Software and Affected Versions: Amazon CloudWatch Agent for Windows versions up to and including v1.247354 Description: A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows. When users trigger a repair of the Agent, a pop-up window opens with...

Zhuhai Suny Technology ESL Tag Forgery / Replay Attacks Vulnerability

Zhuhai Suny Technology ESL Tag suffers from replay attacks and a forgery attack allowing for the displaying of arbitrary contents. ======================================================================= title: Replay attacks & Displaying arbitrary contents product: Zhuhai Suny Technology ESL Tag ...