CVE-2023-29073: Heap-based Buffer Overflow

A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2023-29074: Out-of-bounds Write

A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

iLeakage Attack: Theft of Sensitive Data from Apple’s Safari Browser

By Deeba Ahmed What happens in iLeakage attacks is that the CPU is tricked into executing speculative code that reads sensitive data from memory. This is a post from HackRead.com Read the original post: iLeakage Attack: Theft of Sensitive Data from Apples Safari Browser...

PT-2023-25434 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home app affected versions not specified Description: The Govee Home app has unprotected access to the WebView component, which can be opened by any app on the device. By sending a URL to a specially crafted site, an attacker can execut...

Newly Uncovered ThirdEye Windows-Based Malware Steals Sensitive Data

A previously undocumented Windows-based information stealer called ThirdEye has been discovered in the wild with capabilities to harvest sensitive data from infected hosts. Fortinet FortiGuard Labs, which made the discovery, said it found the malware in an executable that masqueraded as a PDF fil...

SQL Injection Vulnerability in Online Exam System Version v1.0

Online Exam System is an online exam system. Online Exam System v1.0 suffers from a SQL injection vulnerability that originates from the lack of validation of external input SQL statements in the parameters columns, data of /jurusanmatkul/data. An attacker can exploit this vulnerability to execut...

CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline

Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...

File Tracker Manager System SQL注入漏洞

File Tracker Manager System is a file tracker manager system. File Tracker Manager System v1.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the parameter newpassword in the file register/updatepassword.php against externally entered SQL statements. A...

Service Provider Management System SQL Injection Vulnerability (CNVD-2023-38190)

Service Provider Management System is a web-based application by Carlo Montero, an individual developer. It is designed to provide dynamic websites for service provider companies. A SQL injection vulnerability exists in Service Provider Management System version 1.0, which can be exploited by...

Campcodes Coffee Shop POS System SQL Injection Vulnerability

Campcodes Coffee Shop POS System is a coffee shop POS system from Campcodes. Campcodes Coffee Shop POS System v1.0 suffers from a SQL injection vulnerability, which stems from the lack of validation of the parameter id of the file manageproduct.php for externally-entered SQL statements, which can...

Campcodes Advanced Online Voting System SQL Injection Vulnerability

Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/votersrow.php, which can be...

Online Computer and Laptop Store SQL注入漏洞

Online Computer and Laptop Store is an online computer and laptop store by Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to a SQL injection vulnerability in the file /classes/Master.php?f=updateorderstatus, where the parameter id of the function...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. Cloudflare WARP suffers from a security vulnerability that stems from a misconfiguration in its client's manifest file that could allow an attacker to implement execution task...

CVE-2022-41648

The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line,...

Threat in your browser: what dangers innocent-looking extensions hold for users

Whether you want to block ads, keep a to-do list or check your spelling, browser extensions allow you to do all of the above and more, improving convenience, productivity and efficiency for free, which is why they are so popular. Chrome, Safari, Mozilla — these and many other major Web browsers —...

Pharmacy Management System editbrand.php SQL Injection Vulnerability

Pharmacy Management System MPMS is a multilingual pharmacy management system from the personal developer Mayuri K. A SQL injection vulnerability exists in Pharmacy Management System v1.0, which stems from a lack of validation of external input SQL in the id parameter of editbrand.php statements. ...

CVE-2021-40956: Improper Neutralization of Special Elements used in an SQL Command

LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained...

Online Car Wash Booking System SQL注入漏洞（CNVD-2022-53351）

Online Car Wash Booking System is an online car wash booking system from Carlo Montero's personal developer. version v1.0 of Online Car Wash Booking System is vulnerable to SQL injection, which originates from /ocwbs/classes/Master.php?f =deleteservice page lacks validation of external input SQL...

Wedding Management System SQL Injection Vulnerability (CNVD-2022-54280)

Wedding Management System v1.0 contains a SQL injection vulnerability in /Wedding-Management/admin/ budget.php?bookingid=The page lacks validation for external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Online Car Wash Booking System SQL注入漏洞（CNVD-2022-53352）

Online Car Wash Booking System is an online car wash booking system from Carlo Montero's personal developer. version v1.0 of Online Car Wash Booking System is vulnerable to SQL injection, which originates from /ocwbs/classes/Master.php?f =deletevehicle page lacks validation for external input SQL...