Unsanitized input returned in response is conducive to XSS exploitation

Description During the initial installation process it was identified that the "Create user" form that collects user data, does not properly sanitize the data entry and then prints them on the screen with an error message without any apparent validation, thus allowing the insertion of HTML or...

Pair.sol has payable functions with no way of withdrawing that ether

Lines of code Vulnerability details Pair.sol has payable functions with no way of withdrawing that ether Summary Value is deposited on the contract using payable functions but later can't be taken out Impact Locked ether Proof of Concept Pair.adduint256,uint256,uint256 Pair.buyuint256,uint256...

SQLite through 3.40.0 when relying on --safe for execution of an untrusted CLI script does not properly implement the azProhibitedFunctions protection mechanism and instead allows UDF functions such as WRITEFILE.

...

UBUNTU-CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

CVE-2022-46908: Undefined Security Weakness

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

PT-2022-6939

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.40.0 Description The issue is related to errors in the implementation of the azAllowedFunctions protection mechanism in the SQLite database management system's command-line interface. This could allow an attacker to...

Changes not being stored in Delta.sol

Lines of code Vulnerability details Changes not being stored in Delta.sol Impact Functions working without proper storage dealing into unexpected behaviors Proof of Concept function combineInstance memory self, Instance memory delta internal pure if !self.skipCombine self.deltaInBinInternal +=...

SQLite security vulnerabilities

SQLite is a lightweight database that is an ACID compliant relational database management system. A security vulnerability exists in SQLite 3.40.0 and prior versions that stems from not properly implementing the azProhibitedFunctions protection mechanism when relying on --safe to execute untruste...

PT-2022-36807 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions bit read B, dwg decode header variables, and decode R13 RNUMBER. ...

Implementing Security Restrictions and Owner Access Controls on LPDA Smart Contract.

Lines of code Vulnerability details Vulnerability details Impact The new changes to the contract add an additional layer of security and restrict access to certain privileged functions. The buy function now requires that only the owner can purchase tokens, which prevents malicious actors from...

io.quarkus:quarkus-amazon-lambda-http (1.3.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.4.final) +53 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.3.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.9.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.0.cr1) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.9.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.cr1) +51 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.1.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-amazon-lambda-http (1.11.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.4.final) +174 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.11.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.4.final -...

io.quarkiverse.cxf:quarkus-cxf (0.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (0.1.1) +390 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 0.1.1 - io.quarkiverse.cxf:quarkus-cxf-deployment 0.1.1 -...

io.quarkus:quarkus-amazon-lambda-http (1.10.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final) +72 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (1.10.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.10.1.final -...

io.quarkus:quarkus-azure-functions-http (0.23.1), io.quarkus:quarkus-azure-functions-http-deployment (0.23.1) +38 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (0.23.1)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.1 - io.quarkus:quarkus-azure-functions-http-deployment...

Privilege Escalation

github.com/clastix/capsule is vulnerable to privilege escalation. The vulnerability exists in the syncNamespaceMetadata function in namespaces.go because it can edit and remove the owner reference when granted patch capabilities on its namespace...

PT-2022-36803 · Git +1 · C-Blosc2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash has been reported, involving the ZSTD createDDict, blosc run decompression with context, and blosc2 decompress ctx...