CVE-2024-45300 Bypassing promo code limitations with race conditions

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply...

CVE-2024-45300 Bypassing promo code limitations with race conditions

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply...

CVE-2024-45300 Bypassing promo code limitations with race conditions

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply...

CVE-2024-45299

alf.io prior to version 2.0-M5 has an input escaping flaw in preloaded JSON data that can cause installation instability when administrators insert non-escaped text. The issue is mitigated by upgrading to version 2.0-M5, which fixes the escaping problem. The CSP blocks script execution; no exploi...

CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

SUSE CVE-2024-45006

In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure th...

DEBIAN-CVE-2024-45006

In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure th...

Kashipara Bus Ticket Reservation System SQL Injection Vulnerability

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A SQL injection vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from the application's lack of validation of externally-entered SQL statements, and can be exploited by a remote...

Kashipara Bus Ticket Reservation System Cross-Site Scripting Vulnerability

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the Name, Phone, and Email...

Kashipara Bus Ticket Reservation System Cross-Site Request Forgery Vulnerability

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site request forgery vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from /deleteTicket.php not adequately verifying that the request comes from a trusted user, and can be...

Kashipara Bus Ticket Reservation System Cross-Site Scripting Vulnerability (CNVD-2024-38206)

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in /adminschedule.php, and can be...

Kashipara Bus Ticket Reservation System Cross-Site Scripting Vulnerability (CNVD-2024-38207)

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the bookingdate parameter of...

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.3.5...

WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Bus Ticket Booking with Seat Reservation Type Plugin Vulnerable versions = 5.3.5 Fixed in 5.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43985 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 34dc0c71fc7e Credits Sharanabasapp...

CVE-2024-8168

A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. Th...

CVE-2024-8168

A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. Th...

CVE-2024-8168 code-projects Online Bus Reservation Site login.php sql injection

A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. Th...

CVE-2024-8168 code-projects Online Bus Reservation Site login.php sql injection

A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. Th...

CVE-2024-8168

The CVE-2024-8168 issue affects code-projects Online Bus Reservation Site 1.0, specifically a SQL injection in the login.php file via the Username parameter. The vulnerability is exploitable remotely and has been disclosed publicly. Multiple connected sources (Red Hat, NVD, CVE list, CNVD/CNNVD, ...

Online Bus Reservation Site SQL注入漏洞

Online Bus Reservation Site is an online bus reservation site by Fabian Ros Individual Developer. A SQL injection vulnerability exists in Online Bus Reservation Site version 1.0, which is caused by an SQL injection vulnerability in the Username parameter of the login.php page...