No limit in email length may result in a possible DOS attack

Description As per RFC the maximum length allowed for an email address is 255 characters. However, rdiffweb don't validate email length, so you can add email addresses that exceed 255 characters. Through this, if you sign up for an email with a length of 1 million or more and log in, withdraw, or...

PT-2022-25194 · Unknown · Simple College Website

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

PT-2022-19342 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3 through 7.4.2 Liferay DXP versions 7.3 before service pack 3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of...

WP Custom Cursors <= 3.0.1 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin PoC As admin, open...

PT-2022-25170 · Sourcecodester · Sourcecodester Simple Task Managing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Task Managing System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter in the newProjectValidation.php component. Thi...

PT-2022-25169 · Sourcecodester · Sourcecodester Simple Task Managing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Task Managing System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullName parameter in the newProjectValidation.php component. This...

Cross site scripting

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input...

CVE-2022-3245 Code Injection in display of tag title on saving tags in microweber/microweber

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input...

PT-2022-6734

Name of the Vulnerable Software and Affected Versions cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4 Description The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP...

Denial Of Service (DoS)

Jettison is vulnerable to denial of service. The vulnerability exists in nextValue function in JSONTokener.java where the attacker may supply content that causes the parser to crash by out of memory if the parser is running on user supplied input...

PT-2022-18469 · WordPress · The Ketchup Restaurant Reservations

Name of the Vulnerable Software and Affected Versions: The Ketchup Restaurant Reservations WordPress plugin versions 1.0.0 and earlier Description: The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks when a logged-in admin views a malicious reservation made through...

Ruby on Rails: Unexpected deserialization in Kredis

Unexpected classes could be deserialized in Kredis due to the use of JSON.load, potentially leading to security vulnerabilities...

GSD-2022-1005964 scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by...

GSD-2022-1005486 scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by...

GHSA-3MQ5-FQ9H-GJ7J Duplicate Advisory: Denial of Service due to parser crash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8cc-g7j8-xxpm. This link is maintained to preserve external references. Original Description Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running...

GSD-2022-1005101 scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by comm...

DEBIAN-CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

Input validation

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

UBUNTU-CVE-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40153

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...