Admin account TakeOver

Description The endpoint api/system/update-env allows any authenticated users to change env variables of the back-end process : js process.envenvKey = value; The envKey value comes from here : js const envKey, checks = KEYMAPPINGkey; One of the value in the KEYMAPPING dictionnary is : js JWTSecre...

CVE-2023-41154

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

CVE-2023-41154

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

Cross site scripting

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

Malicious code in brum-global-variable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb73c6cef367bf2c5464967ed374a34f64862b3598ebae764c8b292f5d47e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-4039 GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style...

CVE-2023-41154

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

CVE-2023-41154

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

CVE-2023-41154: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...

PT-2023-27829 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: A Stored Cross-Site Scripting XSS issue exists in the scheduled cron jobs tab, allowing remote attackers to inject arbitrary web script or HTML via the value field parameter when creating a new environment...

Fortinet FortiClientEms Information Disclosure Vulnerability

Fortinet FortiClientEms is a centralized central management system from Fortinet, Inc. A security vulnerability exists in Fortinet FortiClientEms that originates from an environment variable information leak in the login page. Affected products and versions: FortiClientEMS versions 7.0.6 through...

CVE-2023-37879 Exposed Session Variable in Wing FTP Server <= 7.2.0

Insecure storage of sensitive information in Wing FTP Server User Web Client allows information elicitation.This issue affects Wing FTP Server: = 7.2.0...

Medium: gcc

Issue Overview: An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature -fstack-protector did not detect or defend against overflows of dynamically-sized local variables. This update to the GCC compiler remedies code generation for th...

CVE-2023-40945

Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php...

Sql injection

Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php...

"rights" stored in memory is overwriting the memory block storing "from" and 32 bytes memory is given to store 20 byes long "contract_"

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Expected code should keccak over packed encoding of rights, from, to, contract, tokenId but as 'rights' values are overwriting 'from' values and 32 bytes memory block has been allocated to 'contract'...

CVE-2023-40946

Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php...

CVE-2023-40945

Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php...

PT-2024-14770

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an unintentional integer overflow in the Linux kernel, specifically in the drm/mediatek component. The problem arises from multiplying two variables of different...

PT-2023-27712 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue concerns SQL Injection in the schoolname variable from the Database, located at header.php. This allows for potential exploitation. Recommendations: For Schoolmate version 1.3, consider restrictin...