PT-2022-21268 · WordPress · Wp Contact Slider

Name of the Vulnerable Software and Affected Versions: WP Contact Slider WordPress plugin versions prior to 2.4.8 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape...

PT-2022-20415 · WordPress · Wp Total Hacks

Name of the Vulnerable Software and Affected Versions: WP Total Hacks WordPress plugin versions through 4.7.2 Description: The issue allows low privilege users to modify the plugin's settings, potentially leading to Stored Cross-Site Scripting attacks against other users, including administrators...

Malicious owner can steal reward tokens

Lines of code Vulnerability details The recoverERC20 function allows the contract owner to transfer arbitrary ERC20 tokens owned by the WardenPledge contract in order to recover tokens sent by mistake to the contract. In order to protect against withdrawal of deposited reward tokens, it includes ...

Using a non-18 decimals token as collateral (for ex. USDT) in a Market will result in multiple value losing situations

Lines of code Vulnerability details Proof of Concept In multiple places in the code, when doing calculations with both debt and price of collateral there is a multiplication by 1e18 - 1 ether. We have the following calculations: uint minimumCollateral = debt 1 ether /...

Oracle.sol uses deprecated Chainlink method latestAnswer()

Lines of code Vulnerability details Proof of Concept Chainlink has market the latestAnswer method as deprecated for his price feeds, but the code is using it. Impact The latestAnswer method just returns the price and has no way to check if it is stale. If the project is using a stale price it can...

recoverERC20 can drain user's funds

Lines of code Vulnerability details recoverERC20 function is deployed so users who have accidently sent erc20 tokens to the contract be able to recover them. recoverERC20 uses ifminAmountRewardTokentoken != 0 revert Errors.CannotRecoverToken; to check if token was set to one of the RewardTokens o...

PT-2022-24019 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.1.8 Description: The issue concerns weak password requirements in the phpMyFAQ repository. Specifically, versions prior to 3.1.8 are affected due to inadequate password length requirements. Version 3.1.8 introduce...

PT-2022-10461 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4.0 Description: The issue concerns SQL Injection, which can be exploited via the file hospital/hms/admin/view-patient.php. This allows for potential unauthorized access or manipulation of data...

PT-2022-21202 · Host Engineering · H0-Ecom100 Communications Module Firmware

Name of the Vulnerable Software and Affected Versions: Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior Description: The issue allows an attacker to cause a stack-based buffer overflow by writing into name or description fields with data larger than the...

PT-2022-24933

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.8.45 Description The StatelessTokenService of the DataHub metadata service does not verify the signature of JWT tokens, allowing an attacker to connect to DataHub instances as any user if Metadata Service...

PT-2022-26204 · Themefusion · Themefusion Avada

Name of the Vulnerable Software and Affected Versions: ThemeFusion Avada premium theme versions = 7.8.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that can lead to arbitrary plugin installation and activation. Recommendations: For ThemeFusion Avada premium theme...

PT-2022-25641 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the "PostEnergyType API" endpoint. Recommendations: For versions prior to...

PT-2022-17069 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows an attacker to discover the existence of resources in a space that the user does not have access to, due to verbose error messaging. Recommendations: At the moment,...

PT-2022-26858 · Dzzoffice · Dzzoffice

Name of the Vulnerable Software and Affected Versions: dzzoffice version 2.02.1 SC UTF8 Description: A Cross-Site Request Forgery CSRF issue allows attackers to create user accounts arbitrarily and grant Administrator rights to regular users. Recommendations: For dzzoffice version 2.02.1 SC UTF8,...

PT-2022-25153 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point in the Editing function of the User module. This is achieved by exploiting a...

PT-2022-26875 · Ip Com · Ip-Com Ew9

Name of the Vulnerable Software and Affected Versions: IP-COM EW9 version 15.11.0.149732 Description: A command injection issue was found in the formSetDebugCfg function, which could potentially be exploited. Recommendations: For IP-COM EW9 version 15.11.0.149732, as a temporary workaround,...

CVE-2022-3095

CVE-2022-3095 affects Dart/Flutter: the Dart URI class uses RFC 3986 syntax for backslash parsing, diverging from WhatWG URL standards and causing incompatibilities with \ in URIs. This can enable authentication bypass in web apps that parse URIs. Affected: Dart versions prior to 2.18 and Flutter...

PT-2022-6759 · Unknown +4 · Jupyter Core +4

Name of the Vulnerable Software and Affected Versions: Jupyter Core versions prior to 4.11.2 Description: The issue is related to arbitrary code execution in jupyter core due to the execution of untrusted files in the current working directory. This allows one user to run code as another,...

CVE-2022-39944 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

In Apache Linkis =1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in...

PT-2022-25301 · Cert · Cert

Name of the Vulnerable Software and Affected Versions: CERT software versions prior to 1.50.5 Description: A Remote Code Injection issue exists, allowing an authenticated attacker to inject arbitrary pickle objects as part of a user's profile. This can lead to code execution on the server when th...