CVE-2022-23072

CVE-2022-23072 : In Recipes (versions 1.0.5–1.2.5), a Stored XSS flaw exists in the Add to Cart flow. An attacker can inject a malicious payload via the Name parameter on the food list page, triggering the XSS when adding to the shopping cart. This could enable the attacker to capture the victim’...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

Duplicate token can be added to MasterChef

Lines of code Vulnerability details Impact MasterChefV2.add does not check if the lpToken is previously added. This would lead to incorrect accounting of lpToken in different pid. Proof of Concept function adduint256 allocPoint, IERC20 lpToken, IRewarder rewarder public onlyOwner uint256...

Malicious code in rc-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f276516a3eaa094c2646799cee2b0c4e2c604ed70d1d512e7168e91c99a808b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5603 Malicious code in rc-add-in-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2970478b3b25a1b749b4e4c2cd0d0f5a97316b27bf5cb5cb07dde2c6002014d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5602 Malicious code in rc-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f276516a3eaa094c2646799cee2b0c4e2c604ed70d1d512e7168e91c99a808b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5407 Malicious code in poll-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc694fc37edc42eafa5a430d831b549c43843b033109b3b63e7c09548a786e54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in poll-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc694fc37edc42eafa5a430d831b549c43843b033109b3b63e7c09548a786e54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sc-add-to-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5948 Malicious code in sc-add-to-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2017-20064

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to...

Directory Management System SQL Injection Vulnerability

Directory Management System is a directory management system. A SQL injection vulnerability exists in Directory Management System v1.0, which stems from a lack of validation of the fullname parameter in add-directory.php against an externally-entered SQL statement. An attacker can exploit this...

Privilege Escalation via edit response body

Description Recently, i found a business logic vulnerabity and this vulnerability allow reader user perform privilege escalation on allaccess user. Because before user perform any function, client-side will perform OPTIONS request to view user permission with specify function via response body. I...

GHSA-9RG7-3J4F-CF4X QueryInterface should call AddRef before returning pointer

Affected version of this crate, which is a required dependency in com-impl, provides a faulty implementation of the IUnknown::QueryInterface method. QueryInterface implementation must call IUnknown::AddRef before returning the pointer, as describe in this documentation: As it is not incrementing...

CVE-2022-26173

JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery CSRF via http://targethost:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts...

CVE-2022-31384

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...

CVE-2022-31384

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...

CVE-2022-31384

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...

CVE-2022-31384

CVE-2022-31384 affects Directory Management System v1.0, with a SQL injection vulnerability in add-directory.php exploitable via the fullname parameter due to insufficient input validation. Affected component is the add-directory.php endpoint; the issue enables arbitrary SQL execution and potenti...