Online Banking System SQL Injection Vulnerability (CNVD-2022-68370)

Online Banking System is a simple banking system project. It is used to manage bank customer accounts and process basic customer transactions.Online Banking System SQL injection vulnerability, which stems from a SQL injection issue in the custid parameter in the /net-banking/editcustomeraction.ph...

CVE-2022-2405

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...

CVE-2022-3024

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...

Cross site request forgery (csrf)

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...

Cross site scripting

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored...

CVE-2022-2405 WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup...

PT-2022-16434 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: WP Popup Builder versions prior to 1.2.9 Description: The issue concerns a lack of authorization and CSRF check in an AJAX action within the WP Popup Builder WordPress plugin. This allows any authenticated users, such as subscribers, to delet...

PT-2022-9492 · WordPress · Scripts Organizer

Name of the Vulnerable Software and Affected Versions: Scripts Organizer WordPress plugin versions prior to 3.0 Description: The issue concerns the lack of capability and CSRF checks in the saveScript AJAX action, which is accessible to both unauthenticated and authenticated users. Additionally,...

CVE-2022-40118

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the custid parameter at /net-banking/sendfundsaction.php...

CVE-2022-40122

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the custid parameter at /net-banking/editcustomeraction.php...

CVE-2022-40122

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the custid parameter at /net-banking/editcustomeraction.php...

MAL-2022-4419 Malicious code in luapkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1056631ef80f2163474304f3663a356bf91439fddc4227ea8e95cfbbdefce50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3824 Malicious code in ing-ges6-mfe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 880d16785b99e2842b3d1a9e8ed8d2a47003ee40be7922518e20d69adccf2135 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6518 Malicious code in testhawaii123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b622e00e5b47c0f7e724899d169d92211866c0130b21dfadad37992e6f5215 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

Z-BlogPHP 代码问题漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. A security vulnerability exists in Z-BlogPHP 1.7.2 and earlier versions, which stems from a server-side request forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file that allows a remote...

A malicious user could stuck crowdfund ETH

Lines of code Vulnerability details Impact A user could freeze funds accumulated in a crowdfund and execute a "fake sale" that would be the approval of the token. Proof of Concept A group of users create a crowdfund, they raise money to buy the most good looking Bored Ape. An attacker would buy i...

CVE-2022-39217

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

Code injection

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

CVE-2022-39217

CVE-2022-39217 affects the GitHub Action some-natalie/ghas-to-csv (GitHub Advanced Security to CSV). The action creates a CSV from the GitHub Advanced Security API without sanitizing API output, enabling potential execution of arbitrary code if a dismissible alert or custom field contains executa...