Design/Logic Flaw

Hidden functionality vulnerability in PIX-RT100 versions RT100TEQ2.1.1EQ101 and RT100TEQ2.1.2EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services...

CVE-2023-22316

Hidden functionality vulnerability in PIX-RT100 versions RT100TEQ2.1.1EQ101 and RT100TEQ2.1.2EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services...

PT-2023-33196 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: The issue concerns a use-after-free in the ip6 fragment function. This problem was introduced in version v4.13 and is fixed in Linux Kernel version v5.15.83. The actual impact and attack...

PT-2023-33391 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.269 Description: The issue concerns a use-after-free in the ip6 fragment function. This problem was introduced in version v4.13 and is fixed in Linux Kernel version v4.19.269. The actual impact and attack...

PT-2023-33585 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.17 Description: The issue is related to the pnode functionality, specifically the termination at peers of the source. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

CVE-2023-22316

Hidden functionality vulnerability in PIX-RT100 versions RT100TEQ2.1.1EQ101 and RT100TEQ2.1.2EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services...

PT-2023-33425 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.302 Description: The issue concerns a use-after-free in the ip6 fragment function. This problem was introduced in version v4.13 and is fixed in Linux Kernel version v4.14.302. The actual impact and attack...

PT-2023-33576 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.17 Description: The issue is related to the eventfd functionality. A helper function, eventfd signal mask, has been introduced. The actual impact and potential for exploitation have not been confirmed yet...

CVE-2023-0122

A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmetsetupauth, allows an attacker to perform a Pre-Auth Denial of Service DoS attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4...

prodigasistemas curupira SQL注入漏洞

curupira is a simple authentication and authorization method from Pródiga Sistemas open source. A SQL injection vulnerability exists in prodigasistemas curupira, which stems from the presence of unknown functionality in the file app/controllers/curupira/passwordscontroller.rb, leading to SQL...

clan7ups SQL注入漏洞

clan7ups is an offshoot of the old Destiny Universal Point System. An SQL injection vulnerability exists in antonbolling clan7ups, which stems from a problem with the unknown functionality of the component Login/Session, leading to SQL injection...

Exploit for Code Injection in Vmware Spring_Cloud_Function

CVE-2022-22963 Exploit Description In Spring Cloud Funct...

PT-2023-10225 · Unknown · Lolfeedback

Name of the Vulnerable Software and Affected Versions: lolfeedback affected versions not specified Description: A critical issue has been found, affecting an unknown functionality, which leads to sql injection. Recommendations: At the moment, there is no information about a newer version that...

Remote code execution

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionalit...

CVE-2022-25027

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked...

classroom-engagement-system SQL注入漏洞

classroom-engagement-system is a classroom engagement system by the individual developer Alexander Harding. A SQL injection vulnerability exists in classroom-engagement-system, which stems from a problem with some unknown functionality that can lead to sql injection...

CVE-2015-10036

A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 87405b74fe651892d79d0dff62ed17a7eaef6a60. It is recommended to apply a patch to fix this...

GIGABYTE XTREME GAMING ENGINE < 1.26 Multiple Vulnerabilities

The version of GIGABYTE XTREME GAMING ENGINE installed on the remote host is prior to 1.26. It is, therefore, affected by multiple vulnerabilities as referenced in GIGABYTE security advisory 1801: - The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE befor...

PT-2023-10215 · Dronfelipe +1 · Dronfelipe

Name of the Vulnerable Software and Affected Versions: kylebebak dronfelipe affected versions not specified Description: A critical issue has been identified, affecting an unknown functionality, which can be manipulated to lead to sql injection. Recommendations: Apply the patch...

CVE-2022-46163 travel-support-program vulnerable to data exfiltration via Ransack query injection

Travel support program is a rails app to support the travel support program of openSUSE TSP. Sensitive user data bank account details, password Hash can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The...