PT-2024-29903 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 34.3.1 Description: A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The getRoomUpgradeHistory function will infinitely recurse in this case, causing the code t...

matrix-js-sdk 安全漏洞

matrix-js-sdk is an application component of Matrix open source. A security vulnerability exists in matrix-js-sdk versions prior to 34.2.0, which stems from a malicious home server that can craft a room or room structure so that the predecessor forms a loop, and the getRoomUpgradeHistory function...

PT-2024-30011 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System version 91caab8 Description: A SQL injection vulnerability was discovered in the Hotel Management System via the book id parameter at the "admin room history.php" endpoint. This issue allows for potential unauthenticat...

Hotel-Management-System 安全漏洞

Hotel-Management-System is a hotel management system by the individual developer Vaibhav Verma. Hotel-Management-System has a security vulnerability that stems from the bookid parameter of adminmodifyroom.php containing an SQL injection vulnerability...

PT-2024-30017 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System version commit 91caab8 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the book id parameter at the "admin modify room.php" endpoint. There is no information...

PT-2024-30015 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System version commit 91caab8 Description: The issue is a SQL injection vulnerability via the room type parameter at the "admin room removed.php" endpoint. This vulnerability allows for potential exploitation. Recommendations...

PT-2024-30013 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System affected versions not specified Description: A SQL injection vulnerability was discovered in the Hotel Management System via the room type parameter at the "admin room added.php" endpoint. This issue allows for potenti...

CVE-2024-42556

CVE-2024-42556 concerns Hotel Management System commit 91caab8 with a SQL injection vulnerability in the room_type parameter of admin_room_removed.php. The vulnerability is identified as network-based with none/low privileges required, no user interaction, and a base score of 9.8 (CRITICAL) affec...

Hotel-Management-System 安全漏洞

Hotel-Management-System is a hotel management system by the individual developer Vaibhav Verma. Hotel-Management-System has a security vulnerability that stems from the bookid parameter of adminroomhistory.php containing an SQL injection vulnerability...

PT-2024-30016 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System affected versions not specified Description: A Cross-Site Request Forgery CSRF issue in the admin modify room.php component of the Hotel Management System allows attackers to escalate privileges. Recommendations: At th...

Hotel-Management-System 安全漏洞

Hotel-Management-System is a hotel management system by the individual developer Vaibhav Verma. Hotel-Management-System has a security vulnerability that stems from the adminroomadded.php component containing a cross-site request forgery vulnerability...

Hotel-Management-System 安全漏洞

Hotel-Management-System is a hotel management system by the individual developer Vaibhav Verma. Hotel-Management-System has a security vulnerability that stems from the adminmodifyroom.php component containing a cross-site request forgery vulnerability...

Hotel-Management-System 安全漏洞

Hotel-Management-System is a hotel management system by the individual developer Vaibhav Verma. Hotel-Management-System has a security vulnerability that stems from the adminroomremoved.php component containing a cross-site scripting vulnerability...

PayPal,Credit Card and Debit Card Payment SQL注入漏洞

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe individual developer. A SQL injection vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can use this vulnerability to send a specially crafted quer...

CVE-2024-6922 Server-Side Request Forgery in Automation 360

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service port 443 or HTTP service port 80 can trigger arbitrary web requests from the server...

CVE-2024-6922: Automation Anywhere Automation 360 Server-Side Request Forgery

Automation 360 Robotic Process Automation suite v21-v32 is vulnerable to unauthenticated Server-Side Request Forgery SSRF. SSRF occurs when the server can be induced to perform arbitrary requests on behalf of an attacker. An attacker with unauthenticated access to the Automation 360 Control Room...

CVE-2024-6922: Automation Anywhere Automation 360 Server-Side Request Forgery

Automation 360 Robotic Process Automation suite v21-v32 is vulnerable to unauthenticated Server-Side Request Forgery SSRF. SSRF occurs when the server can be induced to perform arbitrary requests on behalf of an attacker. An attacker with unauthenticated access to the Automation 360 Control Room...

PT-2024-37960 · Automation Anywhere · Automation 360

Name of the Vulnerable Software and Affected Versions: Automation Anywhere Automation 360 versions v21 through v32 Description: The issue allows an attacker with unauthenticated access to the Automation 360 Control Room HTTPS service port 443 or HTTP service port 80 to trigger arbitrary web...

CVE-2024-39691 Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when...

CVE-2024-6303

Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...