PT-2023-22378 · Unknown · Call Blocker

Name of the Vulnerable Software and Affected Versions: Call Blocker application version 6.6.3 Description: The issue allows an attacker to inject large amounts of data into the application's database, causing it to crash due to an out-of-memory OOM error when it loads the data into memory on...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

CVE-2022-47028

CVE-2022-47028 affects Action Launcher for Android (v50.5). The issue allows an attacker to cause a denial of service via arbitrary data injection in the insert function. Impact: availability disruption as described across multiple sources. A temporary workaround noted for Action Launcher for And...

PT-2023-15137 · Unknown · Action Launcher

Name of the Vulnerable Software and Affected Versions: Action Launcher for Android version 50.5 Description: An issue in Action Launcher for Android allows an attacker to cause a denial of service via arbitrary data injection to the insert function. Recommendations: For Action Launcher for Androi...

CVE-2023-29726

The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the application's database. When the application starts, it loads the data from the database into memory. Once the attacker injects too much data, t...

AndroidRock Call Blocker 安全漏洞

AndroidRock Call Blocker is an application from AndroidRock Inc. It can automatically reject unwanted calls. A security vulnerability exists in AndroidRock Call Blocker version 6.6.3, which originates from the fact that an attacker can use the key component to inject a large amount of dirty data...

CVE-2023-29726

The CVE-2023-29726 entry describes a vulnerability in Call Blocker for Android 6.6.3 where a component is opened that allows an attacker to inject large volumes of data into the app’s database. On startup, the app loads database data into memory, and injecting excessive data triggers an out‑of‑me...

Internet Bug Bounty: CVE-2023-28322: more POST-after-PUT confusion

Libcurl, a popular open-source library for transferring data over HTTPS, had a vulnerability CVE-2023-28322 that could allow an attacker to inject data or cause the application to misbehave. The vulnerability was caused by a logic flaw that could cause libcurl to use the wrong callback function...

Code injection

Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: validatedocupdate list filter filter views using view functions as filters rewrite update This doesn't affect map/reduce or searc...

Complaint Management System Cross-Site Scripting Vulnerability

Complaint Management System is a complaint management system. A cross-site scripting vulnerability exists in Complaint Management System v1.0, which originates in the parameter value of file admin/assets/plugins/DataTables/examples/examplessupport/editableajax.php. Lack of effective filtering and...

curl: CVE-2023-28322: more POST-after-PUT confusion

A vulnerability existed in libcurl that allowed an attacker to inject unintended data or cause a segfault by confusing the POST and PUT methods. The previous fix for this vulnerability was insufficient as it only corrected the CURLOPTPOST option, which is not always used when sending data with th...

nodejs: Incorrect handling of certificate subject and issuer fields

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

CVE-2020-9009

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database via action=shipnotify because access to this endpoint is completely unchecked. The attacker must guess an order number...

Siemens SCALANCE XCM332

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE)

Exploit Title: Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution RCE Date: 2023-02-28 Exploit Author: Anthony Cole Vendor Homepage: https://labcollector.com/labcollector-lims/add-ons/eln-electronic-lab-notebook/ Version: v4.234 Contact: http://twitter.com/acole76...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8487)

Insufficient protection of the inter-process communication functions in ABB System 800xA Base all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling. This plugin only works with Tenable.ot. Please visit...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8485)

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. This plugin only work...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8488)

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities. Th...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8486)

Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling. This plugin only works with Tenable.ot. Please visit...

Important: nodejs

Issue Overview: An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an attacker can use this...