PT-2022-11232 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: An authentication bypass issue exists in the cgiserver.cgi Login functionality. A specially-crafted HTTP request can lead to authentication bypass, allowing an attacker to send an HTTP...

PT-2022-12097 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetPtzPatrol...

PT-2022-12111 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The DelUser para...

PT-2022-12062 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The SetDevName...

PT-2022-12101 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetZoomFocus...

PT-2022-12085 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The login...

Access Restriction Bypass

Moodle is vulnerable to access restriction bypass. The calendar:manageentries capability are not restricted from accessing user level events, allowing user with manager role to edit user events...

WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting

The checkprivacysettings AJAX action of the plugin, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript...

PT-2022-2174 · Pjsip +3 · Pjsip +3

Name of the Vulnerable Software and Affected Versions: PJSIP versions 2.11.1 and prior Description: The issue is related to a buffer overflow in memory when handling RTP/RTCP packets, which can be exploited by a remote attacker to cause a denial of service. PJSIP is a free and open source...

CVE-2022-0333

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events...

GoCD < 21.3.0 Path Traversal

The GoCD web application running on the remote host has the Business Continuity add-on enabled by default. It is, therefore, affected by a directory traversal vulnerability due to an improper access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains...

PT-2022-12281 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript versions 3.0.0 and below Description: A stack overflow issue was discovered in Jerryscript via the ecma find named property function in ecma-helpers.c. Recommendations: For Jerryscript versions 3.0.0 and below, consider restrictin...

The vulnerability of the Storage.save() function in the Django web application framework allows a attacker to access confidential information.

The vulnerability of the Storage.save function in the Django web framework relates to an improper restriction on the path name, which is limited to a directory. Exploiting this vulnerability could allow a malicious actor to access confidential information by sending a specially crafted HTTP file ...

PT-2022-11409 · Qemu +5 · Qemu +5

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 6.2.0 Description: A NULL pointer dereference issue was found in the block mirror layer of QEMU. The self pointer is dereferenced in mirror wait on conflicts without ensuring that it's not NULL. A malicious unprivileged...

PT-2022-12310 · Coins · Coins Construction Cloud

Name of the Vulnerable Software and Affected Versions: COINS Construction Cloud version 11.12 Description: The issue is related to improper input neutralization, making it vulnerable to reflected cross-site scripting XSS via malicious links. This affects the search window and activity view window...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari

Awesome Web Security 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of...

GHSA-75VW-3M5V-FPRH corenlp is vulnerable to Improper Restriction of XML External Entity Reference

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

GHSA-JGM9-XPFJ-4FQ6 Path traversal in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-013 - Vulnerability type: Improper Hardening - Threat...

Path traversal in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-013 - Vulnerability type: Improper Hardening - Threat...

CVE-2022-22553

Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI. An adjacent unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is...