CVE-2023-33007

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2023-33002

Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2023-32986

Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...

CVE-2023-2691

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/additem.php of the component POST Parameter Handler. The manipulation of the argument itemname leads to cross site scripting...

Lost and Found Information System SQL注入漏洞

Lost and Found Information System is a lost and found information system by oretnom23 individual developer. A SQL injection vulnerability exists in SourceCodester Lost and Found Information System version 1.0, which stems from a problem in the file admin/?page=items/manageitem of the component GE...

PT-2023-20885 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical vulnerability was found in the SourceCodester Lost and Found Information System. The issue affects an unknown functionality of the file...

SourceCodester Personnel Property Equipment System 跨站脚本漏洞

Personnel Property Equipment System is a personnel property equipment management system by Jon Remus Sevellejo personal developer. A cross-site scripting vulnerability exists in Personnel Property Equipment System v1.0, which stems from the lack of effective filtering and escaping of user-supplie...

PT-2023-20842 · Sourcecodester · Sourcecodester Personnel Property Equipment System

Name of the Vulnerable Software and Affected Versions: SourceCodester Personnel Property Equipment System version 1.0 Description: A problematic vulnerability was found in the SourceCodester Personnel Property Equipment System. The issue affects an unknown function of the file admin/add item.php,...

SourceCodester Lost and Found Information System SQL注入漏洞

Lost and Found Information System is a lost and found information system by oretnom23 individual developer. SourceCodester Lost and Found Information System version 1.0 suffers from a SQL injection vulnerability that stems from a problem with the file /classes/Master.php?f=deleteitem, which can...

PT-2023-20699 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /classes/Master.php?f=delete item. This issue leads to sql injection and can be exploite...

kernel: NFSD: fix leaked reference count of nfsd4_ssc_umount_item

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4sscumountitem The reference count of nfsd4sscumountitem is not decremented on error conditions. This prevents the laundromat from unmounting the vfsmount of the source file. This patch...

Stored HTML Injection in Item Label

Description If two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. Proof of Concept...

GHSA-2FFP-W665-9MGX Cross Site Scripting in nilsteampassnet/teampass

nilsteampassnet/teampass prior to version 3.0.7 is vulnerable to cross site scripting XSS from item names within a folder...

Cross Site Scripting in nilsteampassnet/teampass

nilsteampassnet/teampass prior to version 3.0.7 is vulnerable to cross site scripting XSS from item names within a folder...

PT-2023-19945 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.7 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject maliciou...

Upgraded Q -> 3 from #635 [1683219244120]

Judge has assessed an item in Issue 635 as 3 risk. The relevant finding follows: Unsafe downcasting PrivatePool.sol - 230, 231 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 3 from #13 [1683219131959]

Judge has assessed an item in Issue 13 as 3 risk. The relevant finding follows: L-6 Consider using OpenZeppelin’s SafeCast library to prevent unexpected errors 3 --- The text was updated successfully, but these errors were encountered: 👍 1 sathishpic22 reacted with thumbs up emoji All reactions 👍...

Upgraded Q -> 2 from #225 [1683100933057]

Judge has assessed an item in Issue 225 as 2 risk. The relevant finding follows: uint256 exponent = baseToken == address0 ? 18 - 4 : ERC20baseToken.decimals - 4; will revert since ERC20baseToken.decimals - 4; causes an underflow --- The text was updated successfully, but these errors were...

Cross-Site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the item description field which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Upgraded Q -> 2 from #882 [1683052816154]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: If royaltyFee 0 and recipient == address0 users will be overcharged --- The text was updated successfully, but these errors were encountered: All reactions...