Foreman 代码注入漏洞

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman that originates from allowing an administrator user to set global parameters...

Ydalb mapicoin 跨站脚本漏洞

Ydalb mapicoin is an application for Ydalb Personal Developer. A cross-site scripting vulnerability exists in Ydalb mapicoin version 1.9.0 and earlier, which stems from a cross-site scripting vulnerability due to the use of unknown input operation parameters...

PT-2023-19745 · Paradox Security Systems · Paradox Security Systems Ipr512

Name of the Vulnerable Software and Affected Versions: Paradox Security Systems IPR512 affected versions not specified Description: The issue allows attackers to cause a denial of service. This can be achieved via the login.html and login.xml parameters. Recommendations: At the moment, there is n...

Human Resources Management System 1.0 SQL Injection

Exploit Title: Human Resources Management System - HRM - Multiple SQLi Date: 16/03/2023 Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link:...

set critical parameters like fee recipient in constrctor.

Lines of code Vulnerability details Impact Loss of fee at certain condition. This can happen, when user call deposit function immediately contracts are deployed. Or when admin forget to update the feeReceient address. There are lot of address that admin has to set once the contract is deployed. S...

How to specify command line parameters when distributing a WEM application

To deploy applications via Workspace Environment management with additional command line parameters...

SEO by Squirrly SEO < 12.1.21 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the "page" and "tab" URL parameters, leading to a Reflected Cross-Site Scripting vulnerability...

Typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in Typecho v.1.2.0, which stems from the existence of a cross-site scripting vulnerability that can be exploited by a remote attacker to execute arbitrary code via Post...

Typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in Typecho v.1.2.0, which is caused by a cross-site scripting vulnerability that can be exploited by remote attackers to execute arbitrary code via arbitrary URL...

CVE-2023-25282

A heap overflow vulnerability in D-Link DIR820LA1FW106B02 allows attackers to cause a denial of service via the config.logtosyslog and logoptdropPackets parameters to mydlinkapi.ccp...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...

WordPress plugin hiWeb Migration Simple 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

node-sqlite3 安全漏洞

node-sqlite3 is an asynchronous, non-blocking SQLite3 interface library based on Node.js. A security vulnerability exists in node-sqlite3 that stems from the fact that Node.js' SQLite3 bindings are vulnerable to the execution of arbitrary JavaScript code if the binding parameters are well-designe...

Unvalidated input in setManagerRight function

Lines of code Vulnerability details Impact The setManagerRight function takes managedRight and managerRight as inputs without validating them This could potentially lead to unexpected results if the input values are not what the function expects. Tools Used Recommended Mitigation Steps Provide...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to improper validation of url parameters in label names or instruction of an entry type located in parameter.js, which allows an attacker to inject and execute malicious JavaScript in the victims browser...

CVE-2023-27894 Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform

SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal...

GHSA-JQV5-7XPX-QJ74 sqlite vulnerable to code execution due to Object coercion

Impact Due to the underlying implementation of .ToString, it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object. Users of sqlite3 v5.0.0 - v5.1.4 are affected by this. Patches Fixed in v5.1.5. All users are recommended to...

Command Injection

emacs is vulnerable to Command Injection. The vulnerability exists because the input parameters are not properly escaped in the hfy-istext-command function, which allows an attacker to inject and execute malicious commands when the file name or directory name contains shell metacharacters...

PT-2023-16922 · Sourcecodester · Sourcecodester Covid-19 Directory On Vaccination System

Name of the Vulnerable Software and Affected Versions: SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System version 1.0 Description: A vulnerability has been found in the system, classified as problematic, affecting an unknown functionality of the file register.php...

Covid-19 Directory On Vaccination System 跨站脚本漏洞

The Covid-19 Directory On Vaccination System is a COVID-19 information management system by an individual developer in Ndueso Okorie, Nigeria. The system will accurately store and retrieve information about COVID-19 vaccinations in order to control the spread of a pandemic. A cross-site scripting...