33 matches found
CVE-2026-58705
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-122761
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58705
A vulnerability exists in the handleEvent function of gscan.cpp , where a missing bounds check can lead to an out of bounds write on the heap . This flaw could enable remote escalation of privilege without requiring additional execution privileges or user interaction. No specific remediation step...
CVE-2026-121545
Dreeve versions prior to 5.8.0 are vulnerable to a missing authentication flaw in the StravaWebhookRequestHandler::handleEvent component. The root cause is the failure to perform necessary signature , verify-token , or owner_id checks. This allows unauthenticated attackers to forge Strava webhook...
CVE-2026-121545 Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...
CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...
PUB-A-503543477
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2022-50942
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacki...
CVE-2022-50942 Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacki...
CVE-2022-50942
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that enables attackers to inject scripts via the icinga.min.js file by exploiting EventListener.handleEvent. This can lead to session hijacking and non-persistent phishing attacks. The issue is described across multiple s...
CVE-2022-50942 Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener
Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacki...
CVE-2023-21048
In handleEvent of nan.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...
VulnCheck KEV: CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
CVE-2022-25322
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
Sql injection
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection...
ZEROF Web Server SQL Injection Vulnerability
ZEROF Web Server is an open source Web framework that simplifies modern Web development . It allows you to build applications without having to worry about package management or routing. ZEROF Web Server has a SQL injection vulnerability that allows HandleEvent SQL injection...
PT-2022-17211
Name of the Vulnerable Software and Affected Versions ZEROF Web Server version 2.0 Description The issue allows for SQL Injection via the /HandleEvent endpoint. Recommendations For ZEROF Web Server version 2.0, consider restricting access to the /HandleEvent endpoint until a patch is available...