CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

Code injection

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

Host Header Injection

remdex/livehelperchat is vulnerable to host header injection. The library does not properly validate the URL for password reset which allows a malicious attacker to generate a fake password link and take over the user account...

Omise: Cross-site scripting on dashboard2.omise.co

Summary: Cross-site scripting XSS is an attack vector that injects malicious code into a vulnerable web application. Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Steps To...

PT-2022-13734

Name of the Vulnerable Software and Affected Versions livehelperchat versions prior to 3.97 Description This issue has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device. It is being...

Multi Store Inventory Management System 1.0 Account Takeover Vulnerability

Exploit Title: Multi Store Inventory Management System - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.bdtask.com/ Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/ Version: 1.0 Tested...

CVE-2022-1177

OpenEMR contains an insecure direct object reference in interface/patient_file/report/custom_report.php (pre-6.1.0). An authenticated user can manipulate the Issue_7 parameter to download arbitrary patient reports, exposing sensitive data. The issue is tracked as CVE-2022-1177 and is documented a...

Fingerprint Attendance 1.0 Account Takeover Vulnerability

Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache Fingerprint...

Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control UAC feature...

Exim Privilege Escalation Vulnerability

Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands...

Online Sports Complex Booking System 1.0 Account Takeover Vulnerability

Exploit Title: Online Sports Complex Booking System - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Version:...

Sysax FTP Automation 6.9.0 - Privilege Escalation Vulnerability

Exploit Author: bzyo @bzyo Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation Vulnerable Software: Sysax FTP Automation 6.9.0 Vendor Homepage: https://www.sysax.com/ Version: 6.9.0 Software Link: https://www.sysax.com/download/sysaxautosetup.msi Tested on: Windows 10 x64 Details:...

Tiny File Manager路径遍历漏洞

Tiny File Manager is a web-based open source file manager. A path traversal vulnerability in the tinyfilemanager.php file upload function in Tiny File Manager 2.4.1 allows remote attackers to upload malicious PHP files to the webroot using a valid user account and achieve code execution on the...

siemens Mendix Forgot Password Appstore module access control impropriety vulnerability (CNVD-2022-17796)

Forgot Password module allows users to register applications or reset their own passwords without administrator involvement. siemens Mendix Forgot Password Appstore module contains a security vulnerability that could be exploited by an attacker to hijack any user account using the registration fl...

Default credentials

In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...

Cross-site Scripting (XSS) - Stored

Description Stored XSS via upload attachment with format .xml in File Library. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of Concept PoC.xml...

JetBrains TeamCity 代码问题漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting. JetBrains TeamCity is vulnerable to a code issue that could be exploite...

Vicidial v2.14-783a - (DB) SQL Injection Web Vulnerability

Document Title: =============== Vicidial v2.14-783a - DB SQL Injection Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2312 Release Date: ============= 2022-02-17 Vulnerability Laboratory ID VL-ID: ====================================...