Human Resources Management System v1.0 - Multiple SQLi

Exploit Title: Human Resources Management System v1.0 - Multiple SQLi Date: 16/03/2023 Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.ht...

PT-2023-17797 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a missing bounds check in the p2p iface.cpp file, which could lead to a possible out of bounds read. This might result in local information disclosure, with Syst...

PT-2023-17457 · Amd · Amdcpmoemsmm

Name of the Vulnerable Software and Affected Versions: AmdCpmOemSmm affected versions not specified Description: The issue is related to insufficient control flow management, which may allow a privileged attacker to tamper with the SMM handler, potentially leading to an escalation of privileges...

PT-2023-16817 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.1.9 and prior Description: The issue allows users with restricted rights to bypass entry permission via id collision when importing or synchronizing entries in the User vault. Recommendations:...

Privilege Escalation

github.com/kubevirt/kubevirt is vulnerable to Privilege Escalation. A remote attacker is able to compromise a specific node and wait until system-critical components with high privileges appear on its node. A compromised node can be used to elevate privileges beyond the node, potentially having...

PT-2023-11938 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate number from the National...

PT-2023-11465 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

PT-2023-14723 · Megafeis +1 · Megafeis +1

Name of the Vulnerable Software and Affected Versions: MEGAFEIS, BOFEI DBD+ Application for IOS & Android version 1.4.4 Description: An issue in the MEGAFEIS, BOFEI DBD+ Application allows an authenticated attacker to gain access to sensitive account information. Recommendations: For version 1.4....

PT-2023-11461 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

GHSA-XVFJ-84VC-HRMF Answer vulnerable to Stored Cross-site Scripting

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.7...

PT-2023-17061 · Answer +3 · Answer +2

Name of the Vulnerable Software and Affected Versions: answer versions prior to 1.0.6 Description: The issue concerns an Observable Response Discrepancy. No further details are provided about the nature of this discrepancy or its potential impact. There is no information available regarding the...

PT-2023-1954 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a lack of authentication for a critical function, which could allow an attacker to achieve unauthenticated remote code execution in the...

PT-2023-16785 · Pacsrapor · Pacsrapor

Name of the Vulnerable Software and Affected Versions: Pacsrapor versions prior to 1.22 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection and Command Line Execution through S...

PT-2023-17064 · Answer +3 · Answer +2

Name of the Vulnerable Software and Affected Versions: answer versions prior to 1.0.6 Description: The issue concerns insufficient session expiration. Recommendations: For versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue...

WordPress Branda Plugin <= 3.4.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Branda Type Plugin Vulnerable versions = 3.4.8.1 Fixed in 3.4.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer WPMU DEV PSID a80ca4d3559a Credits Unknown Required privilege Administrator Publish...

Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Login with an editor user and add/edi...

PT-2023-35718 · Git +1 · P11-Kit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Global-buffer-overflow READ 8. The crash state involves several functions: base C MessageSignFinal, rp...

PT-2023-35703 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash state includes mrb exc get id, mrb no method error, and mrb method missing. No information is available...

PT-2023-18231 · Google · Android 12 +1

Name of the Vulnerable Software and Affected Versions: Quick Share Agent versions prior to 3.5.14.18 in Android 12 Quick Share Agent versions prior to 3.5.16.20 in Android 13 Description: The issue allows a local attacker to access the MAC address without the required permission, potentially...

WordPress Open Graphite Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Open Graphite Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47439 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2e0d810c3c50 Credits minhtuanact Require...