PT-2023-24456 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: mp4v2 version 2.1.2 Description: A memory leak was discovered in mp4v2 via the class MP4BytesProperty. Recommendations: For mp4v2 version 2.1.2, consider restricting access to the MP4BytesProperty class until a patch is available. At the...

WordPress plugin VikBooking Hotel Booking Engine & PMS 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

brettproperty.co.uk Cross Site Scripting vulnerability OBB-3349455

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-V3FV-V9M6-26G3 Jenkins HashiCorp Vault Plugin has improper masking of credentials

Jenkins HashiCorp Vault Plugin 360.v0a1c04cf807d and earlier does not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an...

xorg-x11-server: XIChangeProperty out-of-bounds access

A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs...

xorg-x11-server: XIChangeProperty out-of-bounds access

A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs...

PT-2023-3046 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: mp4v2 version 2.1.3 Description: The issue is related to a memory leak via the MP4StringProperty class in the mp4v2 library, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is also associated with t...

CVE-2023-22706

Unauth. Reflected Cross-Site Scripting XSS vulnerability in PropertyHive plugin = 1.5.48 versions...

Cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/additem.php of the component POST Parameter Handler. The manipulation of the argument itemname leads to cross site scripting...

CVE-2023-2691 SourceCodester Personnel Property Equipment System POST Parameter add_item.php cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/additem.php of the component POST Parameter Handler. The manipulation of the argument itemname leads to cross site scripting...

CVE-2023-2691

SourceCodester Personnel Property Equipment System 1.0 is affected by a cross-site scripting vulnerability in the POST Parameter Handler (admin/add_item.php) where the item_name parameter can be manipulated to inject scripts. Exploitation is possible remotely, and public disclosures exist. Connec...

CVE-2023-2690

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...

CVE-2023-2690

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...

Sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...

CVE-2023-2690 SourceCodester Personnel Property Equipment System GET Parameter returned_reuse_form.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...

CVE-2023-2690

CVE-2023-2690 affects SourceCodester Personnel Property Equipment System 1.0. Affected component: admin/returned_reuse_form.php in the GET Parameter Handler. The vulnerability arises from improper handling of the client_id GET parameter, enabling SQL injection that can be exploited remotely and i...

CVE-2023-2690 SourceCodester Personnel Property Equipment System GET Parameter returned_reuse_form.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returnedreuseform.php of the component GET Parameter Handler. The manipulation of the argument clientid leads t...

Personnel Property Equipment System SQL注入漏洞

Personnel Property Equipment System is a personnel property equipment management system by Jon Remus Sevellejo Personal Developer. A SQL injection vulnerability exists in Personnel Property Equipment System version 1.0, which stems from an incorrect manipulation of the clientid parameter that can...