PT-2022-15837 · Unknown · Openlibrary

Name of the Vulnerable Software and Affected Versions: openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 Description: The issue is related to Reflected XSS. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

PT-2022-4952 · Microsoft · Advertising Universal Event Tracking (Uet) Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Microsoft Advertising Universal Event Tracking UET WordPress plugin versions prior to 1.0.4 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when the unfiltered html capability ...

Wrong implementation of withdrawAdminFees() can cause the adminFees to be charged multiple times and therefore cause users' fund loss

Lines of code Vulnerability details function withdrawAdminFeesSwap storage self, address to internal IERC20 memory pooledTokens = self.pooledTokens; for uint256 i = 0; i pooledTokens.length; i++ IERC20 token = pooledTokensi; uint256 balance = self.adminFeesi; if balance != 0 token.safeTransferto,...

PT-2022-21949

Name of the Vulnerable Software and Affected Versions got package versions prior to 12.1.0 got package versions prior to 11.8.5 Description The issue allows a redirect to a UNIX socket. This is related to the got package for Node.js. Recommendations For versions prior to 12.1.0, update to version...

amountAMin and amountBMin set to 1

Lines of code Vulnerability details in the function swapAndAddLiquidity it makes a call addLiquidity with amountAMin and amountBMin hard coded to 1 recommend specifying a proper amountAMin and amountBMin rather than 1 --- The text was updated successfully, but these errors were encountered: All...

PT-2022-3909 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.3.0 Description: The issue is related to command injection vulnerabilities in the web server's ajax endpoints functionalities. A specially-crafted network packet can lead to arbitrary command execution. An attacker ca...

PT-2022-19733 · Unknown · Connect-Multiparty

Name of the Vulnerable Software and Affected Versions: Connect-Multiparty version 2.2.0 Description: An arbitrary file upload vulnerability in the file upload module allows attackers to execute arbitrary code via a crafted PDF file. Recommendations: For Connect-Multiparty version 2.2.0, consider...

PT-2022-25605

Name of the Vulnerable Software and Affected Versions SolarView Compact version 6.00 Description A command injection issue was discovered via the network test.php file. Recommendations For SolarView Compact version 6.00, as a temporary workaround, consider restricting access to the network test.p...

PT-2022-2957 · Sonicwall · Sonicwall Sma1000

Name of the Vulnerable Software and Affected Versions: SonicWall SMA1000 series firmware versions 12.4.0, 12.4.1-02965 and earlier Description: The issue is related to open redirection, where a user-controlled input specifies a link to an external site, and this link is used in a redirect. This...

PT-2022-4323 · Intel · Intel Processors

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to an observable behavioral discrepancy in some IntelR Processors, which may allow an authorized user to potentially enable information disclosure via local...

PT-2022-6454 · Unknown · Zk Framework

Name of the Vulnerable Software and Affected Versions: ZK Framework versions 8.6.4.1, 9.0.1.2, 9.5.1.3, 9.6.0.1, 9.6.1 Description: The issue is related to the AuUploader component of the ZK Framework, which allows attackers to access sensitive information via a crafted POST request. This can...

CVE-2021-22556 Integer Overflow in Fuchsia Kernel

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond...

PT-2022-13436 · WordPress · Woocommerce Shipping Multiple Addresses

Name of the Vulnerable Software and Affected Versions: Multiple Shipping Address Woocommerce WordPress plugin versions prior to 2.0 Description: The issue concerns the improper sanitization and escaping of numerous parameters in SQL statements via certain AJAX actions. These actions are available...

User can call liquidate() and steal all collateral due to arbitrary router call

Lines of code Vulnerability details Impact A malicious user is able to steal all collateral of an unhealthy position in PARMinerV2.sol. The code for the liquidate function is written so that the following steps are followed: User calls PARMinerV2.liquidate PARMinerV2 performs the liquidation with...

PT-2023-14045 · Unknown +6 · Freeradius +5

Name of the Vulnerable Software and Affected Versions: freeradius affected versions not specified Description: The EAP-PWD function compute password element in freeradius leaks information about the password, allowing an attacker to substantially reduce the size of an offline dictionary attack...

PT-2022-7201 · Libtiff +1 · Libtiff +1

Name of the Vulnerable Software and Affected Versions: LibTIFF master branch Description: The issue is related to an out-of-bounds read in the LZWDecode function in libtiff/tif lzw.c:624, which can be exploited by attackers to cause a denial-of-service via a crafted tiff file. This can be done...

PT-2022-9049 · Graphisoft · Graphisoft Bimx Desktop Viewer

Name of the Vulnerable Software and Affected Versions: Graphisoft BIMx Desktop Viewer version 2019.2.2328 Description: An exploitable code execution issue exists in the file format parsing functionality. A specially crafted file can cause a heap buffer overflow, resulting in code execution. An...

CVE-2022-24849 Contact to DisCatSharp-owned server using authenticated client

DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two RequireDisCatSharpDeveloperAttributes or the BaseDiscordClient.LibraryDeveloperTeam have potentially had their bot token sent to ...

PT-2022-11905 · Cmsimple · Cmsimple

Name of the Vulnerable Software and Affected Versions: CMSimple version 5.4 Description: The issue is related to Cross Site Scripting XSS via the file upload feature. Recommendations: For CMSimple version 5.4, consider disabling the file upload feature until a patch is available to prevent...

PT-2022-17942 · Mingsoft · Mingsoft Mcms

Name of the Vulnerable Software and Affected Versions: Mingsoft MCMS version 5.2.7 Description: A SQL injection issue was discovered in Mingsoft MCMS. The issue is related to the /cms/content/list API endpoint. Recommendations: For Mingsoft MCMS version 5.2.7, consider restricting access to the...