equanimity 路径遍历漏洞

equanimity is a world-building game by A. F. Dudley, a solo developer with an emphasis on squad-based turn-based combat and balance. equanimity 2014-04-23 and earlier versions are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filte...

vprj 路径遍历漏洞

vprj is an open source repository for whmacmac. A security vulnerability exists in version 2022-04-06 and earlier versions of vprj, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

BaiduWenkuSpider_flaskWeb 路径遍历漏洞

BaiduWenkuSpiderflaskWeb is a python web project based on the FlaskFrame framework for crawling Baidu's library by ChangeWeDer personal developer. path traversal vulnerability exists in versions of BaiduWenkuSpiderflaskWeb prior to 2021-11-29, which The vulnerability stems from a failure of the...

wormnest 路径遍历漏洞

wormnest is a Python3 Flask/SQL-Alchemy web server for URL narrowing and manipulating file services by individual developer John Torakis in Greece. A path traversal vulnerability exists in wormnest version 0.4.7, which stems from insecure use of the Flask sendfile function...

SetupBox 路径遍历漏洞

SetupBox is a middleware for implementing your own storage cloud by Kim Taehwan, an individual developer in Korea. A security vulnerability exists in SetupBox version 1.0 and earlier versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

Malicious code in firestore-messagebird-send-msg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce66f4ad982ef4095727b82f1dabf12365216e3f0dc4b1cd8016bf310fa982c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3052 Malicious code in firefox-send (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7de757c8958df7dfd963bd4bdc07d46cda7037dd27fc4ef63d00012c236ae1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in firefox-send (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7de757c8958df7dfd963bd4bdc07d46cda7037dd27fc4ef63d00012c236ae1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Upgraded Q -> M from 205 [1655579891083]

Judge has assessed an item in Issue 205 as Medium risk. The relevant finding follows: transfer and send methods are used inside the codebase. Since these methods use 2300 gas stipend which is not adjustable,it may likely to get broken when calling a contract's fallback function if any contract...

Upgraded Q -> M from 119 [1655579861612]

Judge has assessed an item in Issue 119 as Medium risk. The relevant finding follows: L01: Use .call instead of .send Line References Description It is recommended to use call instead of send because the former fowards all remaining gas with the call, while the latter has a gas limit of 2300. Thi...

Upgraded Q -> M from 117 [1655579798819]

Judge has assessed an item in Issue 117 as Medium risk. The relevant finding follows: Don't use send / transfer to send ETH This is low severity but you should avoid these and use call --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from 180 [1655579854185]

Judge has assessed an item in Issue 180 as Medium risk. The relevant finding follows: Use of send might fail in the future send only forward 2300 gas which may break when gas cost change in a future ETH upgrade see: function withdrawAll public payable onlyOwner...

GHSA-X4MQ-M75F-MX8M Delegate functions are missing `Send` bound

Affected versions of this crate did not require event handlers to have Send bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior. The flaw was corrected in commit afe3252 by adding Send bounds...

AtomicBucket<T> unconditionally implements Send/Sync

In the affected versions of the crate, AtomicBucket unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::datawith API. Such data races can potentially cause memory corruption or other undefined behavior. The flaw was...

GHSA-3HXH-7JXM-59X4 AtomicBucket<T> unconditionally implements Send/Sync

In the affected versions of the crate, AtomicBucket unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::datawith API. Such data races can potentially cause memory corruption or other undefined behavior. The flaw was...

CVE-2022-32300

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php...

WordPress plugin Private Messages 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Private Messages plugin 2.1.10 and earlier versions are vulnerable to cross-site request...

YouDianCMS SQL注入漏洞

YouDianCMS is a website CMS. A SQL injection vulnerability exists in YoudianCMS v9.5.0, which originates from the lack of validation of the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php against external SQL input. This vulnerability can be exploited by attackers to execute...

undertow: Double AJP response for 400 from EAP 7 results in CPING failures

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second...

CVE-2021-35487

Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates for the Manage Alerts page via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user,...