506 matches found
Toll Tax Management System 安全漏洞
Toll Tax Management System is a toll tax management system by the individual developer Carlo Montero. A security vulnerability exists in Toll Tax Management System version 1.0, which originates from a cross-site scripting vulnerability in the owner parameter of managerecipient.php...
PT-2024-34498 · Sourcecodester · Toll Tax Management System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Toll Tax Management System version 1.0 Description: A Cross-site Scripting XSS issue in the manage recipient.php file allows remote authenticated users to inject arbitrary web scripts via the owner input field. Recommendations:...
UBUNTU-CVE-2024-43438
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report...
PT-2024-10069
Name of the Vulnerable Software and Affected Versions mutt and neomutt affected versions not specified Description The issue is related to PGP encryption in mutt and neomutt, where the --hidden-recipient mode is not used. This may lead to the leakage of the Bcc email header field by inferring fro...
CVE-2024-7204 Ai3 QbiBot - Stored XSS
Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack...
CVE-2024-5969
The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomaticsendemail' function which are reachable via AJAX...
PT-2024-37280 · WordPress · The Aiomatic
Name of the Vulnerable Software and Affected Versions: The AIomatic - Automatic AI Content Writer for WordPress versions up to, and including, 2.0.5 Description: The issue is due to insufficient limitations on the email recipient and the content in the aiomatic send email function, which are...
age Plugins
age is a file encryption tool, library, and format. It lets you encrypt files to “recipients” and decrypt them with “identities”. $ age-keygen -o key.txt Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p $ tar cvz /data | age -r...
CVE-2023-41093
Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0...
Siemens RUGGEDCOM 信息泄露漏洞
Siemens RuggedCom ROS is an operating system from Siemens, Germany, used in the RuggedCom series of switches. An information disclosure vulnerability exists in Siemens RUGGEDCOM ROS, which can be exploited by an attacker to retrieve a MACSEC key and access decrypt Ethernet frames sent by an...
PT-2024-28677 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.5 Mattermost version 9.8.0 Description: The issue arises from the improper sanitization of recipients of a webhook event, allowing an attacker who is monitoring these events to obtain the channel IDs of...
CVE-2024-28063
Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS...
Mozilla: S/MIME signature accepted despite mismatching message date
The Mozilla Foundation Security Advisory: The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despi...
collectLiquidity() Lack of can specify recipient leads to inability to retrieve token1 after entering the blacklist of token0
Lines of code Vulnerability details Vulnerability details LP has only one way to retrieve token, first decreaseLiquidity, then retrieve through the collectLiquidity method. collectLiquidity only has one parameter, tokenId. function collectLiquidity uint256 tokenId external override nonReentrant...
DEBIAN-CVE-2023-50761
The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be...
_safeMint() should be used rather than _mint() wherever possible
Lines of code 139, 178, 204 Vulnerability details mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...
_safeMint() should be used rather than _mint() wherever possible
Lines of code 139, 178, 204 Vulnerability details mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...
UBUNTU-CVE-2023-43377
A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatarioemail1 parameter...
CVE-2023-38751
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation...
RngRelayAuction.rngComplete() DOS attack
Lines of code Vulnerability details Impact If the recipient maliciously enters the blacklist of priceToken, it may cause rngComplete to fail to execute successfully Proof of Concept The current implementation of RngRelayAuction.rngComplete immediately transfers the prizeToken to the recipient...