2022 matches found
PT-2022-37022
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the CFF::Charset::collect glyph to sid map function, c...
HCL Technologies HCL Sametime File Upload Vulnerability
HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6. The vulnerability stems from the fact that the user SID in the application can be modified, which can be exploited to modify the SID to enable arbitrary file...
CVE-2021-27771
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...
Arbitrary file deletion
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...
CVE-2021-27771
CVE-2021-27771 affects HCL Sametime (version 11.6 per CNVD) where an attacker can modify the user SID stored in cookies to trigger arbitrary file upload or deletion of directories, leading to a Denial of Service. The vulnerability arises from SID handling within the Sametime chat/file transfer fl...
CVE-2021-27771: Unrestricted Upload of File with Dangerous Type
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...
PT-2022-9859
Name of the Vulnerable Software and Affected Versions Sametime chat application affected versions not specified Description The issue allows modification of the User SID, which can result in Arbitrary File Upload or deletion of directories, causing a Denial of Service. Users of the Sametime chat...
Denial Of Service (DoS)
dpdk:sid is vulnerable to denial of service. The vulnerability exists in vhostusersetinflightfd because it does not validate msg-payload.inflight.numqueues which allows an attacker to cause an out-of-bounds memory read/write...
Sourcecodester Baby Care System SQL注入漏洞（CNVD-2022-35533）
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability, which originates from /admin.php?id=siteoptions&social=edit&sid=insid parameter missing validation of external input...
Sourcecodester Baby Care System SQL注入漏洞（CNVD-2022-35525）
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability that originates in /admin/siteoptions.php & social=remove & sid= where the sid parameter lacks validation for externa...
CVE-2022-28431
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2...
PT-2022-19021
Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/admin/siteoptions.php" endpoint with specific parameters, including social=remove and sid=2. Recommendations For Baby...
Sourcecodester Baby Care System SQL注入漏洞
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability that originates in /admin/siteoptions.php & social=remove & sid= where the sid parameter lacks validation for externa...
PT-2022-19022
Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin.php" endpoint with specific parameters such as id, social, value, and sid. For example, the...
PT-2022-19024
Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /admin.php endpoint, specifically when the id parameter is set to siteoptions, the social parameter is...
CVE-2022-25226
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the serve...
CVE-2022-25226
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the serve...
Authentication flaw
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the serve...
ThinVNC 安全漏洞
ThinVNC is a remote desktop implementation based on HTML5 and AJAX. A security vulnerability exists in ThinVNC version 1.0b1, which stems from the application's lack of authentication. An unauthenticated attacker can bypass the authentication process by using "http://thin-vnc:8080/cmd?cmd=connect...
Denial Of Service (DoS)
dcraw:sid is vulnerable to denial of service.An integer overflow is possible when the victim runs dcraw with a maliciously crafted X3F input image, allowing arbitrary code to be executed in the victim's system...