CVE-2021-39432

diplib v3.0.0 is vulnerable to Double Free...

Double free

diplib v3.0.0 is vulnerable to Double Free...

CVE-2021-39432

diplib v3.0.0 is vulnerable to Double Free...

CVE-2021-39432

CVE-2021-39432 affects the DipLib library (diplib) v3.0.0 and is a Double Free vulnerability. The CVSS 3.1 base metrics assign a MEDIUM overall score of 6.5 with Availability impact HIGH and no confidentiality/integrity impact, network attack vector, low complexity, and requires user interaction....

CVE-2022-42749

CVE-2022-42749 affects CandidATS 3.0.0. The flaw is a cross-site scripting (XSS) vulnerability in the ajax.php resource, specifically via the page parameter, allowing an attacker to inject scripts and potentially steal cookie-based authentication credentials in the victim’s browser. Affected comp...

GHSA-6X93-H9G3-9PHR otp-generator before v3.0.0 insecurely generates random one-time passwords

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...

CSV Injection

Overview csv-safe is a decorates the ruby CSV library to sanitize output CSV against CSV injection attacks. Affected versions of this package are vulnerable to CSV Injection by not filtering out special characters % and |. Remediation Upgrade csv-safe to version 3.0.0 or higher. References - GitH...

CVE-2022-24811 Cross-site Scripting in Combodo iTop

Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds...

CVE-2021-44988

Removed by vendor...

CVE-2021-46020

An untrusted pointer dereference in mrbvmexec of mruby v3.0.0 can lead to a segmentation fault or application crash...

CVE-2021-46020

An untrusted pointer dereference in mrbvmexec of mruby v3.0.0 can lead to a segmentation fault or application crash...

CVE-2021-46020

An untrusted pointer dereference in mrbvmexec of mruby v3.0.0 can lead to a segmentation fault or application crash...

CVE-2021-46020

An untrusted pointer dereference in mrbvmexec of mruby v3.0.0 can lead to a segmentation fault or application crash...

CVE-2020-8123

CVE-2020-8123 affects Strapi up to v3.0.0-beta.18.3 and earlier. The vulnerability arises in the admin console where installPlugin/uninstallPlugin paths pass user input to execa after a regex check, allowing argument injection via inputs like -h, --help, -v, or --version. This can cause the serve...

CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

CVE-2017-2102

CVE-2017-2102 describes a cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool “AppGoat” for Web Application, version 3.0.0 and earlier. The issue can allow remote attackers to hijack the authentication of administrators through unspecified vectors. Connected so...

CVE-2017-2102

Cross-site request forgery CSRF vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2017-2101

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors...

JVN#71666779: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Impact If a user accesses a malicious web page, arbitrary code may b...

OpenCimetiere v3.0.0-a5 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: OpenCimetiere v3.0.0-a5 | Blind SQL Injection Date: 06/08/16 Exploit Author: Wad Deek Vendor Homepage: http://www.openmairie.org/ Software Link: http://www.openmairie.org/catalogue/opencimetiere/ Version: 3.0.0-a5 +3.0.0-a5...