The vulnerability of the component_id and object_id parameters of the Netcat landing CMS system allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the componentid and objectid parameters in the Netcat landing CMS system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

CVE-2024-5128

An Insecure Direct Object Reference IDOR vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any datasetprompt or datasetpromptvariation within any dataset or project. The issue ste...

Online Pet Shop We App 跨站脚本漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in SourceCodester Online Pet Shop We App version 1.0, which stems from the fact that incorrect manipulation of the parameter oid can lead to cross-site...

SUSE CVE-2007-1413

Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument object id...

The vulnerability in the driver drivers/net/wireless/rndis_wlan.c of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the driver drivers/net/wireless/rndiswlan.c of the Linux operating system is related to a numerical overflow in the buffer of the rndisqueryoid function during addition operations. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

parse-server's session object properties can be updated by foreign user if object ID is known

Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...

GHSA-6W4Q-23CF-J9JP parse-server's session object properties can be updated by foreign user if object ID is known

Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...

PT-2022-24823 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.15 Parse Server versions 5.0.0 through 5.2.5 Description: A user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to...

Authentication flaw

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP reque...

in aquilacms/aquilacms

✍️ Description Unauthenticated API function allows any user to change OR view another user first name, last name, password, and address information. As well, leaked activateAccountToken and resetPassToken can be viewed. 🕵️‍♂️ Proof of Concept The attacker can guess the correct MongoDBobject ID and...

CVE-2020-13825

A cross-site scripting XSS vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter...

Denial of Service (DoS)

Overview bson is an a fully featured BSON specification implementation in Ruby. Affected versions of this package are vulnerable to Denial of Service DoS. The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby as used in rubygem-moped allows remote attackers to cause a denial of service work...

The vulnerability of the _asn1_expand_object_id function (p_tree) in the Libtasn1 library of the Debian GNU/Linux operating system, related to resource management errors, allows a perpetrator to cause a service failure.

The vulnerability of the asn1expandobjectid function in the Libtasn1 library for the Debian GNU/Linux operating system is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2019-11827

Cross-site scripting XSS vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the objectid parameter...

PT-2019-12512 · Synology · Note Station

Name of the Vulnerable Software and Affected Versions: Synology Note Station versions prior to 2.5.3-0863 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the object id parameter. Recommendations: For versions prior to 2.5.3-0863, update...

Schneider Electric U.Motion Builder track_import_export.php object_id unauthenticated command injection vulnerability

U.motion Builder is a builder product from Schneider Electric France. A security vulnerability exists in Schneider Electric U.Motion Builder trackimportexport.php objectid. The vulnerability is due to the application failing to properly validate and filter this parameter and can be exploited by a...

curl and nss-pem security and bug fix update

curl 7.29.0-51 - require a new enough version of nss-pem to avoid regression in yum 1610998 7.29.0-50 - remove dead code, detected by Coverity Analysis - remove unused variable, detected by GCC and Clang 7.29.0-49 - make curl --speed-limit work with TFTP 1584750 7.29.0-48 - fix RTSP bad headers...

UBUNTU-CVE-2018-1000654

GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in asn1expandobjectidptree, after a long time, the program will be killed. This attack appears to be exploitable via...

CVE-2018-13860

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/menu/getObjectEditor.xml" URL, using a "?oid=systemSetup&id=0" or "?oid=systemUsers&id=0" GET...

CVE-2018-7765

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter...