DayByDay CRM Information Disclosure Vulnerability

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...

PT-2022-11382 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions 12.0.0 through 15.1.1 Description: A flaw was found in Keycloak that allows an attacker with any existing user account to create new default user accounts via the administrative REST API, even when new user registration is...

Vulnerabilities fixed in HCL Technologies Digital Experience

A Server Side Request Forgery SSRF vulnerability has been fixed in HCL Technologies Digital Experience formerly known as IBM WebSphere Portal. The vulnerability potentially allows a malicious person able to gain access to systems that they initially should not have access to. The researchers who...

PT-2022-10054 · Mcafee · Mcafee Application/Change Control

Name of the Vulnerable Software and Affected Versions: McAfee Application and Change Control MACC versions prior to 8.3.4 Description: A security issue allows a locally logged-in attacker to bypass application protection, enabling them to run applications that would normally be blocked. The...

PT-2022-1406

Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.25 Django versions 3.2 through 3.2.10 Django versions 4.0 through 4.0.0 Description The issue is related to the UserAttributeSimilarityValidator component in the Django framework, which can cause significant...

Improper Authorization in saleor/saleor

Title GraphQL traversal due to missing permission checks Description orders and customers fields allow to access each other via nodes edges. However, connections don't check user's permissions, which allows, for instance, a staff with just Customers permissions get full information about the orde...

PT-2025-7991

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc8 nextqueue-devqueue-02643-g23f3121aca93 Description A use-after-free issue has been identified in the Linux kernel. The problem arises when the free irq cpu rmap function is called after devm free irq,...

PT-2025-8354

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the data-race issue in ip6 datagram connect and udpv6 sendmsg Description A data-race issue exists in the Linux kernel, specifically in the ip6 datagram connect and udpv6...

PT-2022-12246 · Biostar · Biostar Racing Gt Evo

Name of the Vulnerable Software and Affected Versions: Biostar RACING GT Evo version 2.1.1905.1700 Description: An issue was discovered in BS RCIO64.sys. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations, or call a...

WordPress plugin Contact Form Advanced Database security bypass vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin Contact Form Advanced Database 1.0.8 and earlier versions have a security bypass vulnerability that stems from the absence of any...

PT-2021-8083 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the incorrect initialization of dev-work after calling input register device in the appletouch component of the Linux kernel. This may cause a warning in flush...

CVE-2021-43856

Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser e.g...

PT-2021-10556 · Qibosoft · Qibosoft

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: The issue allows attackers to arbitrarily delete files through the /admin/index.php?lfj=mysql&action=del endpoint. The action parameter is used with the value del to perform the deletion. Recommendations: For...

PT-2021-24298 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: Metersphere version 1.15.4 Description: An arbitrary file upload issue was discovered, allowing unauthenticated users to upload files to any directory. This could enable attackers to write a cron job for command execution. Recommendations: Fo...

Business Logic Errors in janeczku/calibre-web

Description There is a possibility to create 2 public phasing shelfs that have the same name, which is a business logic error. Steps To Reproduce 1. Create a shelf with empty name 2. Tick the share with everyone box 3. Create another shelf with empty name 4. Tick the share with everyone box, it...

ROS-2-443

2.443 Vulnerabilities in Squid Proxy Server 1. Vulnerability description: Problems are present in the code processing the "@" block at the beginning of a URL "user@host" and allow bypassing access restriction rules, poisoning cache contents and performing a cross-site scripting attack.Identifier...

CVE-2021-38015

CVE-2021-38015 affects the Chromium-based browser engine. The provided security advisories describe an inappropriate implementation in the input handling of Chromium (prior to 96.0.4664.45) that could allow a user-assisted attacker who persuades a user to install a malicious extension to bypass n...

PT-2021-24241 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS version 2.4.0 Description: A crafted packet from a UE can cause a crash in the SGW-U/UPF component. This issue can potentially be used to deploy a denial-of-service DoS attack on private 5G networks. Recommendations: For Open5GS versi...

PT-2021-21064 · Foreman +2 · Foreman +2

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 2.4.1 Foreman versions prior to 2.5.1 Foreman versions prior to 3.0.0 Description: A server-side remote code execution issue was found in the Foreman project. An authenticated attacker could use Sendmail configuratio...

PT-2021-14827 · Unknown · Ic Module Cma

Name of the Vulnerable Software and Affected Versions: iC Module CMA version 5.0 Description: A stack-based buffer overflow issue exists in the CMA check udp crc function. This can be triggered by a specially-crafted packet, leading to a buffer overflow during a call to memcpy. An attacker can...