1241 matches found
CVE-2023-20912
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
PT-2023-17702 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a missing permission check in the onActivityResult method of AvatarPickerActivity.java. This could allow access to images belonging to other users, potentially...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
CVE-2021-37499
CRLF vulnerability in Reprise License Manager RLM web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP headers...
PT-2023-12323 · Reprise · Reprise License Manager
Name of the Vulnerable Software and Affected Versions: Reprise License Manager RLM versions through 14.2BL4 Description: The issue concerns a CRLF vulnerability in the Reprise License Manager RLM web interface. This vulnerability is located in the password parameter of the View License Result...
GSD-2023-1000830 NFSD: Finish converting the NFSv2 GETACL result encoder
NFSD: Finish converting the NFSv2 GETACL result encoder This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...
PT-2023-10244 · Unknown · Aenbleidd Find
Name of the Vulnerable Software and Affected Versions: AenBleidd FiND affected versions not specified Description: A critical vulnerability was found in AenBleidd FiND, affecting the init result function of the file validator/my validator.cpp. The manipulation leads to buffer overflow...
FFmpeg 代码问题漏洞
FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. FFmpeg has a code issue vulnerability that stems from the vp3decodeframe function in its libavcodec/vp3.c file that does not reasonably check the return result of the avmalloc function, whi...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
A flaw was found in PostgresQL. This flaw allows an attacker to benefit from a miss escaping character and leads to a SQL injection attack due to Java.sql.ResultRow.refreshRow implementation from PGSQL...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of an insecure regular expression within the result variable. Note: The regex is vulnerable on its own, but the vulnerable function is not reachable as shipped in the package...
CVE-2022-36783
AlgoSec – FireFlow Reflected Cross-Site-Scripting RXSS A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user victim. JavaScript code is executed on...
PT-2022-23622 · Algosec · Algosec Fireflow
Name of the Vulnerable Software and Affected Versions: AlgoSec FireFlow affected versions not specified Description: The issue involves a Reflected Cross-Site-Scripting RXSS attack. A malicious user can inject JavaScript code into the IntersectudRule parameter on the "search/result.html" page. By...
CVE-2022-42021
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=...
CVE-2022-42021
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=...
Sql injection
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=...
PT-2022-26209 · Unknown · Student Result Management System
Name of the Vulnerable Software and Affected Versions: Best Student Result Management System version 1.0 Description: The issue concerns SQL Injection. It can be exploited via the "/upresult/upresult/notice-details.php?nid=" endpoint, specifically through the nid variable. Recommendations: For Be...
Best Student Result Management System SQL注入漏洞
Best Student Result Management System is a student result management system by Mayuri K. Individual developer. A security vulnerability exists in version 1.0 of Best Student Result Management System, which stems from an SQL injection issue in the /upresult/upresult/notice-details.php?nid= locatio...
