CVE-2022-1176

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2022-1176

LiveHelperChat CGI issue CVE-2022-1176 involves a loose comparison that enables Insecure Direct Object Reference (IDOR) across multiple endpoints in LiveHelperChat prior to version 3.96. Affected software: LiveHelperChat (web-based live support system). Root cause: loose comparison leading to IDO...

CVE-2022-1176

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2022-1176 Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2022-1176: Access of Resource Using Incompatible Type

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44312

The CVE-2021-44312 entry affects Firmware Analysis and Comparison Tool (FACT) version 3.2. A cross-site request forgery (CSRF) vulnerability exists in the web application, stemming from insufficient validation that requests originate from trusted users. Consequence: logged-in administrators could...

CVE-2021-44310

Summary: CVE-2021-44310 affects Firmware Analysis and Comparison Tool (FACT) v3.2. With administrator privileges, an attacker can perform stored XSS by injecting JavaScript/HTML through the user creation functionality. The vulnerability arises from insufficient data validation/filtering of user-s...

CVE-2021-44312: Cross-Site Request Forgery (CSRF)

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44310: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality...

PT-2022-12039

Name of the Vulnerable Software and Affected Versions Firmware Analysis and Comparison Tool version 3.2 Description The issue allows an attacker with administrator privileges to perform stored XSS attacks by inserting JavaScript and HTML code in the user creation functionality. Recommendations Fo...

PT-2022-12040

Name of the Vulnerable Software and Affected Versions Firmware Analysis and Comparison Tool version 3.2 Description An issue allows logged in administrators to be targeted by a CSRF attack through visiting a crafted web page. Recommendations For Firmware Analysis and Comparison Tool version 3.2,...

openssl security update

1.0.2k-25fips - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison Orabug: 32467026 - Add DH support changes for SP 800-56A rev3 requirements Orabug: 32467059 - Add TLS KDF self-test Orabug: 32467193 - Add EC keys pairwise consistency test Orabug: 32467059 1:1.0.2k-25 -...

GHSA-Q8HG-PF8V-CXRV Symfony Http-Kernel has non-constant time comparison in UriSigner

When checking the signature of an URI an ESI fragment URL for instance, the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability...

imagemagick:encoder_miff_fuzzer: Heap-use-after-free in LocaleCompare

Detailed Report: https://oss-fuzz.com/testcase?key=5152154454720512 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodermifffuzzer Job Type: libfuzzerasani386imagemagick Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0xf634c3c0 Crash State: LocaleCompare...

OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...

OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...

Simple Mobile Comparison Website 1.0 Cross Site Scripting

Exploit Title: Simple Mobile Comparison Website v1.0 - Reflected Cross-Site Scripting XSS Unauthenticated Author: Ayedh AlQahtani Discovery Date: 2022-03-18 Vendor Homepage: https://www.sourcecodester.com/ Tested Version: v1.0 Tested on: XAMPP, Windows 11 Pro x64 es Vulnerability Type: Reflected...

Simple Mobile Comparison Website SQL Injection Vulnerability

Simple Mobile Comparison Website is a mobile comparison website by Carlo Montero's personal developer. Simple Mobile Comparison Website is vulnerable to SQL injection and no details of the vulnerability are available...