CVE-2021-4253 ctrlo lenio Ticket Lenio.pm cross site scripting

A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument siteid leads to cross site scripting. It is possible to launch the attack remotely. The nam...

CVE-2022-4591 mschaef toto Email Parameter cross site scripting

A vulnerability was found in mschaef toto up to 1.4.20. It has been declared as problematic. This vulnerability affects unknown code of the component Email Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.21 is able ...

CVE-2022-4590 mschaef toto Todo List cross site scripting

A vulnerability was found in mschaef toto up to 1.4.20. It has been classified as problematic. This affects an unknown part of the component Todo List Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.21 is able to...

CVE-2022-4587 Opencaching Deutschland oc-server3 Login Page login.tpl cross site scripting

A vulnerability, which was classified as problematic, has been found in Opencaching Deutschland oc-server3. This issue affects some unknown processing of the file htdocs/templates2/ocstyle/login.tpl of the component Login Page. The manipulation of the argument username leads to cross site...

CVE-2022-4582 starter-public-edition-4 cross site scripting

A vulnerability was found in starter-public-edition-4 up to 4.6.10. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.6.11 is able to address this issue. The...

Token decimals may be above 18 leading to underflow issues

Lines of code Vulnerability details Impact In both StableVault and Trading, there is an assumption that token decimal amounts are =18. However this can break if token decimals are 18, resulting in underflow which can lead to unpredictable behaviors, and extreme amounts during deposits and...

CVE-2022-4564 University of Central Florida Materia API Controller api.php before cross-site request forgery

A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to...

PT-2022-14726 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read in the decrypt 1 2 function of CryptoPlugin.cpp due to a missing bounds check. This could lead to local information disclosure without requiring...

Unprotected contract

Lines of code Vulnerability details Impact Anyone can call makeNewDraw and become admin. src/VRFNFTRandomDrawFactory.sol function makeNewDrawIVRFNFTRandomDraw.Settings memory settings external returns address address admin = msg.sender; // Clone the contract address newDrawing =...

CVE-2022-4560 Joget wflow-core UniversalTheme.java getInternalJsCssLib cross site scripting

A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to...

CVE-2022-4559 INEX IPX-Manager list.foil.php cross site scripting

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

PT-2022-27579 · Unknown · Semanticdrilldown Extension

Name of the Vulnerable Software and Affected Versions: SemanticDrilldown Extension affected versions not specified Description: A problematic vulnerability has been found in the SemanticDrilldown Extension, affecting the printFilterLine function of the file includes/specials/SDBrowseDataPage.php ...

Might lose manager forever

Lines of code Vulnerability details Impact If project sets new manager with a typo, might lose manager forever Proof of Concept function setManager address manager public onlyOwner manager = manager; https://twitter.com/realgmhacker/status/1603362870699429889?s=20&t=vm4wY1ITefLhCW8BDa0oig...

CVE-2022-4556 Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting...

CVE-2022-4511 RainyGao DocSys path traversal

A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.DocSystem.controller.UserControllergetUserImg. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely...

PT-2022-21352 · Apache · Apache Bookkeeper Java Client

Name of the Vulnerable Software and Affected Versions: Apache Bookkeeper Java Client versions prior to 4.14.6 and 4.15.1 Description: The Apache Bookkeeper Java Client does not close the connection to the bookkeeper server when TLS hostname verification fails, leaving it vulnerable to a...

CVE-2022-4520 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the...

PT-2022-8697 · Unknown · Easywebpack-Cli

Name of the Vulnerable Software and Affected Versions: easywebpack-cli versions prior to 4.5.2 Description: A Directory Traversal issue allows attackers to obtain sensitive information by sending a crafted GET request. Recommendations: For versions prior to 4.5.2, update to version 4.5.2 or later...

Siemens APOGEE/TALON Field Panels

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: APOGEE PXC/TALON TC Vulnerabilities: Predictable Exact Value from Previous Values 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack...

DEBIAN-CVE-2022-23520

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...