PT-2024-40403 · Osv · Osv

Name of the Vulnerable Software and Affected Versions: OSV affected versions not specified Description: The issue allows users to specify a non-url malicious script as the redirection path without validation. When users follow this URL, they may inadvertently allow the script to execute within...

No validation for the partyFactory contract !

Lines of code Vulnerability details Impact Malicious party contract can be deployed ! Proof of Concept Party contracts are created by the proxyFactory contract . In the initialize function , the proxyFactory contract address is provided by the user which may bring catastrophic consequences . This...

GHSA-9W5F-MW3P-PJ47 Prototype Pollution(PP) vulnerability in setByPath

Summary There is a Prototype PollutionPP vulnerability in dot-diver. It can leads to RCE. Details javascript //https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277 // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access objectToSetlastKey = value In this code, there is ...

CVE-2023-33291

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. It cannot be exploited with e-mail addresses or phone numbers that are registered in the application...

PT-2023-24273 · Ebankit · Ebankit

Name of the Vulnerable Software and Affected Versions: ebankIT version 6 Description: The issue concerns the public endpoints "/public/token/Email/generate" and "/public/token/SMS/generate" which allow generation of OTP messages to any e-mail address or phone number without validation. However, i...

PT-2023-13457 · Microsoft · Active Directory

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows users of certain browsers using Active Directory AD to sign-in to Octopus Server to bypass authentication checks. These users can be redirected to the configured...

Wedding Management System 代码问题漏洞

Wedding Management System v1.0 is an arbitrary file upload vulnerability in the packageedit.php page, which is caused by a lack of validation of the image upload port on the packageedit.php page. The vulnerability is caused by the lack of validation of uploaded files on the packageedit.php page,...

WordPress E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The WordPress VikBooking Hotel Booking Engine & PMS plugin is vulnerable to arbitrary file uploads due to...

MaxSite CMS 路径遍历漏洞

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project . Maxsite CMS has arbitrary file deletion vulnerability , the vulnerability stems from all-files-update-ajax.php in the dir and deletefile parameters for the file name lack of validation , the attacker c...

CVE-2021-41067

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation o...

Update 17.9 for Microsoft Dynamics 365 Business Central 2020 Release Wave 2 (Application Build 17.9.28504, Platform Build 17.0.28458)

None None...

etcd: Large slice causes panic in decodeRecord method

A flaw was found In etcd, where a large slice causes panic in the decodeRecord method. The size of a record is stored in the length field of a WAL file, and no additional validation is performed on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionall...

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A flaw was found in Wildfly. A remote deserialization attack is possible in the Enterprise Application Beans EJB due to lack of validation/filtering capabilities in wildfly. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availablity...

CVE-2020-11882

The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly...

File Upload Vulnerability in the Backend of UWA Universal Building System

UWA is a general-purpose website builder based on PHP and MySQL. UWA general-purpose site-building system background file upload vulnerability , the vulnerability is due to the UWA background allows customized php template files , and in the saving of the content of the PHP file does not do the...

CVE-2018-17660

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

NVIDIA Driver - UVMLiteController ioctl Handling Unchecked InputOutput Lengths Privilege Escalation

NVIDIA Driver - UVMLiteController ioctl Handling Unchecked InputOutput Lengths Privilege Escalation / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=880 The \.\UVMLiteController device is created by the nvlddmkm.sys driver, and can be opened by any user. The driver handles...

SN News 1.2 - '/admin/loger.php' Authentication Bypass

SN News Date: 06/06/2012 Version: 1.2 Software Link: http://phpbrasil.com/script/JHnpFRmSBqlf/sn-news ISRAEL Author will be not responsible for any damage. Vulnerable Code - /admin/logar.php 4-15: 4.$login = $POST"login"; 5.$senha = $POST"senha"; 6.$sql = "select from newsadm where login='$login'...