PT-2022-26939 · Unknown · Salon Booking System

Name of the Vulnerable Software and Affected Versions: Salon booking system versions prior to 7.9 Description: A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script. Recommendations: For versions prior to 7.9, update to version 7.9 or later to resolve...

CVE-2022-46366

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the also unsupported 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no...

PT-2022-28190 · Varnish · Varnish Cache

Name of the Vulnerable Software and Affected Versions: Varnish Cache versions prior to 6.0.11 Description: A request forgery attack can be performed on Varnish Cache servers with the HTTP/2 protocol enabled. An attacker may introduce invalid characters through HTTP/2 pseudo-headers, causing the...

PT-2022-8737 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate number from the National...

PT-2022-19784 · Delta Industrial Automation · Dialink

Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 Description: The issue arises from the software's failure to properly neutralize special elements within a pathname constructed from external input. This pathname is intend...

PT-2022-27772 · Airtable · Airtable.Js

Name of the Vulnerable Software and Affected Versions: Airtable.js versions prior to 0.11.6 Description: The issue arises from a misconfigured build script in the Airtable.js source package, which bundles environment variables into the build target of a transpiled bundle. Specifically, the AIRTAB...

PT-2023-15616 · Uniswap · Uniswap Universal Router

Name of the Vulnerable Software and Affected Versions: Uniswap Universal Router versions prior to 1.1.0 Description: The issue concerns the mishandling of reentrancy in the Uniswap Universal Router, which could have allowed the theft of funds. Recommendations: For versions prior to 1.1.0, update ...

MINTING OF NFT AT WILL

Lines of code Vulnerability details Impact register is an unrestricted public function where any new msg.sender is going to get through the modifier onlyUnregistered. With a non-zero recipient argument passed into the function, a new NFT is going to be minted to the recipient. Consequently, an...

The First Turnile Mint Token ID starts with 0.

Lines of code Vulnerability details Impact The First Turnile Mint Token ID starts with 0. Proof of Concept After deployment, the first Turnile token ID to be minted when a user calls the register function, is 0. At this point, the currentTokenId becomes 1 but the token doesn’t exist until the...

jaerenkort.net Cross Site Scripting vulnerability OBB-3075373

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

evm_hooks ignores some important errors

Lines of code Vulnerability details Impact Some contracts and some Turnstile tokens nfts wll not be able to receive CSR fees forever. Proof of Concept In evmhooks.go, the PostTxProcessing will call h.processEventsctx, receipt to handle Register and Assign events from Turnstile contract first:...

CVE-2022-41926 Nextcloud Talk Android broadcast incorrect permission handling

Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are...

CVE-2022-39346 Missing length validation of user displayname in nextcloud server

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to...

PT-2023-2664

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6, 20 Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1 Description The issue is related to insufficient input validation in the JSSE component of Oracle Java SE and Orac...

PT-2022-24906 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. There are no known workarounds for this issue. Recommendations: For versions prior t...

CVE-2022-42895

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2capcore.c's l2capparseconfreq function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e...

UBUNTU-CVE-2022-42896

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code execution and leaking kernel memory respectively remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via...

PT-2022-27525 · Unknown · Alarm Instance Management

Name of the Vulnerable Software and Affected Versions: Alarm instance management versions prior to 2.0.6 Description: The issue is related to command injection in alarm instance management when a specific command is configured, affecting only logged-in users. Recommendations: For versions prior t...

PT-2022-28220 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 8.19.1 through 9.0.0 Description: The issue concerns hidden functionality introduced by the maintainer, causing the package to output audio and/or video messages unrelated to its intended functionality. This behavior is n...

PT-2022-26795 · Unknown · Billing System Project

Name of the Vulnerable Software and Affected Versions: Billing System Project version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the orderId parameter at the "printOrder.php" endpoint. Recommendations: For Billing System Project...