7617 matches found
CVE-2022-36079 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the component rleUncompress. Remediation Upgrade tinyexr to version 1.0.6 or higher. References - GitHub Commit - GitHub Issue - GitHub PR Credit: 0xdd96...
PT-2022-23167 · Unknown · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.14 Parse Server versions prior to 5.2.5 Description: Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. These fields are...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via wordexp function by using backticks, leading to Command Injection. Remediation Upgrade tinygltf to version 2.8.13 or higher. References - Chromium Bugs - GitHub Commit - GitHub Issue Credit: Oliver Chang...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
master-de.com Cross Site Scripting vulnerability OBB-2877899
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Denial of service
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOSTUSERGETINFLIGHTFD / VHOSTUSERSETINFLIGHTFD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master...
CVE-2022-0669
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOSTUSERGETINFLIGHTFD / VHOSTUSERSETINFLIGHTFD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master...
PT-2022-06: Stack-based buffer overflow in ASUSTOR Data Master (ADM)
The vulnerability was identified in ASUSTOR Data Master ADM versions 3.5.9.RUE3 and below, 4.0.5.RVI1 and below, 4.1.0.RJD1 and below. The discovered vulnerability allows remote authenticated users to execute arbitrary code through the WebDAV protocol in susceptible versions of ASUSTOR Data Maste...
Ingredients Stock Management System SQL Injection Vulnerability
Ingredients Stock Management System is an ingredient stock management system by Carlo Montero. v1.0 of the Ingredients Stock Management System is vulnerable to SQL injection, which originates from the /classes/Master .php?f=deletewaste location has an SQL injection issue with the id parameter. No...
Ingredients Stock Management System SQL Injection Vulnerability (CNVD-2023-11186)
Ingredients Stock Management System is an ingredient stock management system from Carlo Montero's personal developer. v1.0 of the Ingredients Stock Management System is vulnerable to SQL injection, which originates from the /classes/Master .php?f=deletecategory location of the id parameter has a...
CVE-2022-36682
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletestudent...
CVE-2022-36683
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletepayment...
Hackers Breach LastPass Developer System to Steal Source Code
Password management service LastPass confirmed a security incident that resulted in the theft of certain source code and technical information. The security breach is said to have occurred two weeks ago, targeting its development environment. No customer data or encrypted passwords were accessed,...
Simple Task Scheduling System SQL注入漏洞
Simple Task Scheduling System is a simple task scheduling system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Simple Task Scheduling System v1.0, which stems from a security issue with the id parameter in classes/Master.php?f=deleteschedule...
Simple Task Scheduling System SQL注入漏洞
Simple Task Scheduling System is a simple task scheduling system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Simple Task Scheduling System v1.0, which stems from a security issue with the id parameter in /classes/Master.php?f=deletestudent...