CVE-2023-42453

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...

PT-2023-28352 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.93.0 Description: The issue allows users to forge read receipts for any event if they know the room ID and event ID. Although users cannot view the events, they can mark them as read, potentially causing confusion ...

Nevado JMS 安全漏洞

Nevado JMS is a Skyscreamer open source JMS driver for the Queue and Notification Service SQS/SNS for AmazonWeb Services. A security vulnerability exists in Nevado JMS version v1.3.2, which stems from a lack of security checks when receiving messages, and can be exploited by an attacker to execut...

CVE-2023-27202

Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php...

CVE-2023-27202

Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php...

Best POS Management System SQL注入漏洞

Best pos management system is a best pos management system by Mayuri K. Individual developer. A security vulnerability exists in Best POS Management System version 1.0, which originates from a SQL injection vulnerability via the id parameter in /kruxton/receipt.php...

SUSE CVE-2016-9776

QEMU aka Quick Emulator built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcffecreceive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading t...

Upgraded Q -> 2 from #621 [1675724705438]

Judge has assessed an item in Issue 621 as 2 risk. The relevant finding follows: L2 - mintReceipt function lacks a check to verify if the quest has already ended mintReceipt function missing check for ended quest. This could result in a scenario where a receipt is minted after the quest has ended...

Upgraded Q -> 2 from #670 [1675726386915]

Judge has assessed an item in Issue 670 as 2 risk. The relevant finding follows: L-03 DoS if address owns too many receipts With time it is viable for users to acquire thousands and tens of thousands of receipts. This may happen as a result of buying receipts for example, which was highlighted as...

OXHOO TP50 授权问题漏洞

The OXHOO TP50 is a receipt printer from OXHOO. A security vulnerability exists in the OXHOO TP50 OXH1.50 that originates from allowing an unauthenticated attacker to access the administration panel...

CVE-2022-30628

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...

CVE-2022-32333

Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=...

CVE-2022-32333

Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=...

Fast Food Ordering System SQL注入漏洞

Fast Food Ordering System is a fast food ordering system from Carlo Montero's personal developer. version 1.0 of Fast Food Ordering System is vulnerable to SQL injection, which originates from /ffos/admin/sales/receipt.php?id=page missing validation of external input SQL statements, which can be...

CVE-2022-30000

Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?reciptno=...

CVE-2022-30000

Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?reciptno=...

CVE-2022-23884

Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::read packet deserializer...

Mojang Bedrock Dedicated Server 输入验证错误漏洞

Mojang Bedrock Dedicated Server is an official Minecraft Bedrock Edition server software from the Swedish company Mojang. Mojang Bedrock Dedicated Server is vulnerable to an integer overflow vulnerability that can be exploited by remote attackers to cause a PurchaseReceiptPacket::read packet...

Unrestricted Upload of File with Dangerous Type

Description In recent Crater version bed05fc2 tag: 6.0.4 privileged user can upload PHP file as expense receipt. Proof of Concept POST /api/v1/expenses/59/upload/receipts HTTP/1.1 Host: 172.17.0.1:8888 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:98.0 Gecko/20100101 Firefox/98.0 Accept: /...

The vulnerability in the implementation of the tipc_crypto_key_rcv() function for the TIPC protocol, which is used for intra-cluster communication in Linux operating systems, allows a attacker to cause a service failure or gain increased privileges.

The vulnerability of the implementation of the tipccryptokeyrcv function in the Linux operating system’s Transparent Inter-Process Communication TIPC kernel relates to insufficient input validation when processing MSGCRYPTO messages. Exploiting this vulnerability can allow an attacker to cause...