Dot diver security breach

Dot diver is a lightweight, powerful and dependency-free TypeScript utility library that provides types and functions for working with object paths in the dot representation. A security vulnerability exists in Dot diver versions prior to 1.0.2. An attacker can exploit the vulnerability to remotel...

GHSA-9W5F-MW3P-PJ47 Prototype Pollution(PP) vulnerability in setByPath

Summary There is a Prototype PollutionPP vulnerability in dot-diver. It can leads to RCE. Details javascript //https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277 // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access objectToSetlastKey = value In this code, there is ...

Prototype Pollution(PP) vulnerability in setByPath

Summary There is a Prototype PollutionPP vulnerability in dot-diver. It can leads to RCE. Details javascript //https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277 // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access objectToSetlastKey = value In this code, there is ...

PT-2023-8584 · Dot-Diver · Dot-Diver

Name of the Vulnerable Software and Affected Versions: dot-diver versions prior to 1.0.2 Description: The issue is related to a Prototype Pollution vulnerability in the setByPath function, which can lead to remote code execution RCE. This vulnerability allows an attacker to modify object...

CVE-2023-45019

Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database...

SUSE CVE-2020-1147

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'...

SUSE CVE-2020-1722

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this...

SUSE CVE-2020-8116

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...

SUSE CVE-2021-2122

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

SUSE CVE-2023-46490

SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the formactions function in the managers.php function...

PT-2023-30746 · WordPress · Wp Meta/Date Remover

Name of the Vulnerable Software and Affected Versions: WP Meta and Date Remover WordPress plugin versions prior to 2.2.0 Description: The issue concerns an AJAX endpoint for configuring plugin settings that lacks capability checks and fails to sanitize user input. This input is later output...

Projectworlds Online Art gallery project SQL Injection Vulnerability

Projectworlds Online Art gallery project is an online art gallery project by Projectworlds India. A SQL injection vulnerability exists in Projectworlds Online Art gallery project v1.0, which stems from the lnm parameter in header.php that does not validate incoming characters and sends them...

SourceCodester Library System SQL Injection Vulnerability

Library System is a library management system by nurhodelta17 individual developer. SourceCodester Library System version 1.0 suffers from a SQL injection vulnerability that stems from the parameter category in the file index.php that causes sql injection...

Koha SQL Injection Vulnerability

Koha is a Koha organization's system for automated library management and site building. A security vulnerability exists in Koha Library Software version 23.0.5.04 and earlier that could allow a remote attacker to obtain sensitive information via Intranet/cgi bin/cataloging/ysearch.pl...

PT-2023-29323 · Unknown · Koha Library

Name of the Vulnerable Software and Affected Versions: Koha Library Software versions 23.0.5.04 and before Description: The issue allows a remote attacker to obtain sensitive information via the "intranet/cgi-bin/cataloging/ysearch.pl" component. This is a SQL Injection vulnerability...

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers allows a hacker to execute arbitrary code.

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers involves reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Ibermática RPS 2019 Log Information Disclosure Vulnerability

Ibermática RPS 2019 is an ERP software from Ibermática. Ibermática RPS 2019 suffers from a log message disclosure vulnerability that originates from an attacker being able to download a log file that contains a password hash encoded using the AES-CBC-128 bit algorithm, which can be decrypted usin...

CVE-2023-43044

IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 266893...

CVE-2022-4244

A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...

DEBIAN-CVE-2022-4244

A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...