The vulnerability of the LoadObj function of the .obj Tinyobjloader loader allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failure.

The vulnerability of the LoadObj function of the .obj Tinyobjloader loader is related to unvalidated array indexing. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures through the use of a malicious file...

WordPress plugin JobSearch WP JobSearch 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress JobSearch WP JobSearch plugin has a...

m.otelyagci.com Open Redirect vulnerability OBB-2460504

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1032

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

ResearchGate Automatic Question Paper Generator System 跨站脚本漏洞

ResearchGate Automatic Question Paper Generator System 1.0 is an automatic question paper generation system from ResearchGate, a German company. A cross-site scripting vulnerability exists in the account page component /aqpg/users/login.php, where the last name parameter lacks a validation filter...

Joomla! SQL注入漏洞

Joomla! is a set of forum components used in the Joomla! content management system. SQL injection vulnerabilities exist in versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0. The vulnerability stems from the application's lack of validation of externally entered SQL statements. An attacker cou...

CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A SQL injection...

CVE-2022-0591

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3get AJAX action, leading to SSRF issues exploitable by unauthenticated users...

WordPress plugin FormCraft 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A code issue vulnerability previously existed in the WordPres...

MISP 跨站脚本漏洞

MISP is a software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.156, which stem fro...

The vulnerability of the threat detection mechanism of Microsoft Defender for IoT, which stems from the lack of proper validation of the user-inputted string, allows attackers to escalate their privileges or execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism is related to the lack of proper validation of the string entered by the user before it is used to execute system commands. Exploiting this vulnerability can allow attackers to enhance their privileges or execute...

Adobe Acrobat Reader Dc缓冲区错误漏洞

Adobe Acrobat Reader Dc is a Pdf reading tool from Adobe USA. Adobe Acrobat Reader DC versions 21.007.20099 and earlier, 20.004.30017 and earlier, and 17.011.30204 and earlier contain a buffer error vulnerability that stems from the fact that the vulnerability stems from a networked system or...

CVE-2022-0165

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kcgetthumbn AJAX action available to both unauthenticated and authenticated users...

Zenario CMS 代码问题漏洞

Zenario CMS is an open source application from Zenario. A file upload vulnerability exists in Zenario CMS version 9.0.54156, which stems from the application's lack of validation of uploaded files. An attacker could exploit the vulnerability to upload malicious files to remotely execute arbitrary...

WordPress plugin SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is a WordPress application plugin. WordPress MOLIE plugin 0.5 and earlier versions have a SQL injection vulnerability, which stems from the failure of MOLIE to validate and escape SQL...

Nacos 跨站脚本漏洞

Nacos is a dynamic service discovery, configuration and service management platform for Alibaba China. It supports DNS-based and RPC-based service discovery, and can provide features such as providing real-time health checks and blocking services from sending requests to unhealthy hosts or servic...

Luocms 安全漏洞

Luocms v2.0 is an article management system. Luocms v2.0 is vulnerable to an arbitrary file-writing vulnerability that results from insufficient validation of filecontent submissions and filenamede filenames, which can be exploited to write arbitrary shell files via /admin/templates/templatemanag...

CVE-2021-24825

The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion...

CVE-2021-24216

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations...