mooSocial mooTravel Cross Site Scripting Vulnerability

mooSocial mooTravel is a multi-platform, portable, user-friendly script from mooSocial, Inc. for building community-driven content sharing and social networking sites. A cross-site scripting vulnerability exists in mooSocial mooTravel version 3.1.8. An attacker could exploit this vulnerability to...

CVE-2023-3834 Bug Finder EX-RATE Ticket create cross site scripting

A vulnerability was found in Bug Finder EX-RATE 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack may be...

CVE-2022-28737

There's a possible overflow in handleimage when shim tries to load and execute crafted EFI executables; The handleimage function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code...

CVE-2022-28737

There's a possible overflow in handleimage when shim tries to load and execute crafted EFI executables; The handleimage function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code...

CVE-2022-28737 There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables

There's a possible overflow in handleimage when shim tries to load and execute crafted EFI executables; The handleimage function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code...

CVE-2023-3753

A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The...

Arbitrary command execution on Windows

Description Opening files from an untrusted directory can lead to execution of arbitrary commands on Windows systems, this is possible by having a malicious file with the same name as a trusted executable, Windows gives priority to the current directory when searching for executables. Several...

Debian dla-3484 : firefox-esr - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3484 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3484-1 [email protected]...

CVE-2023-3543

A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/firstname/secondname/address1/country leads to...

CVE-2023-21129

In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the background due to a BAL bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

Malicious code in fc-collabsible (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7cf2a1c7cafc2f63b3b6da7c03ad9e5bb35508693b37096982b17e947379aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-48440

In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges...

SUSE CVE-2022-24695

Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with...

CVE-2023-3004

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=readmsg of the component POST Parameter Handler. The manipulation of the argument convoid leads to sql...

CVE-2023-33245

Minecraft through 1.19 and 1.20 pre-releases before 7 Java allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink...

OpenSSL -- Possible DoS translating ASN.1 identifiers

The OpenSSL project reports: Severity: Moderate. Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow...

PT-2023-16521 · Zephyrproject +1 · Zephyr

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows for the input of an invalid pointer, which can cause the device to crash. With more knowledge of the device's memory layout, further exploitation is possible...

CVE-2023-2962

A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edituser. The manipulation of the argument id leads to sql injection. The attack may be launched...

PT-2023-22092 · Unknown · Nfine Rapid Development Platform

Name of the Vulnerable Software and Affected Versions: NFine Rapid Development Platform version 20230511 Description: A vulnerability was found in the NFine Rapid Development Platform, affecting some unknown functionality of the file "/SystemManage/Organize/GetTreeGridJson?...

PT-2023-21305 · Sourcecodester · Sourcecodester Online Exam System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Exam System version 1.0 Description: A critical issue has been found in the processing of the file /jurusanmatkul/data, where the manipulation of the argument columns1data leads to SQL injection. The attack can be...