PT-2022-20997

Name of the Vulnerable Software and Affected Versions Rescue Dispatch Management System version 1.0 Description The issue concerns SQL Injection. It can be exploited via the "/rdms/admin/incident reports/manage report.php" API endpoint, specifically through the id variable. Recommendations For...

PT-2022-20706

Name of the Vulnerable Software and Affected Versions Online Car Wash Booking System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the "/ocwbs/admin/vehicles/manage vehicle.php" endpoint, specifically through the id variable. Recommendations For...

PT-2022-21014

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=teams/manage team&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access or...

PT-2022-21015

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=teams/view team&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access or...

CVE-2022-31739

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when downloading files on Windows, the % character was not escaped, which could have led to a download incorrectly saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%...

PT-2022-20692

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to SQL Injection. It can be exploited via the "/ordering/admin/stockin/index.php?view=edit&id=" endpoint. The id variable is vulnerable to SQL injection attacks...

Mozilla Firefox buffer error vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox, which originates from an invalid memory read due to an uninitialized variable...

Security Vulnerabilities fixed in Firefox 101 — Mozilla

A malicious website could have learned the size of a cross-origin resource that supported Range requests. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. When exiting fullscreen mode, an iframe could have...

Mozilla Firefox < 101.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 101.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-20 advisory. - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Tea...

BathPair.sol#rebalancePair() can be front run to steal the pending rebalancing amount

Lines of code Vulnerability details function underlyingBalance public view returns uint256 uint256 pool = IERC20underlyingToken.balanceOfaddressthis; return pool.addoutstandingAmount; function removeFilledTradeAmountuint256 amt external onlyPair outstandingAmount = outstandingAmount.subamt; emit...

Arbitrary Command Injection

sharp is vulnerable to arbitrary command injection. An attacker is able to set the value of the PKGCONFIGPATH environment variable in a build environment which allows arbitrary command injection at npm install time...

OPENSUSE-SU-2022:0148-1 Security update for varnish

This update for varnish fixes the following issues: varnish was updated to release 7.1.0 boo1195188 CVE-2022-23959 VCL: It is now possible to assign a BLOB value to a BODY variable, in addition to STRING as before. VMOD: New STRING strftimeTIME time, STRING format function for UTC formatting...

GHSA-4G82-3JCR-Q52W Malware in ctx

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of os.environ.items when instantiating Ctx objects. The captured environment variables were sent as a base64 encoded query...

CVE-2022-29256

CVE-2022-29256 affects sharp (Node.js image processing) versions prior to 0.30.5. If an attacker can control PKG_CONFIG_PATH in the build environment, they may inject arbitrary commands at npm install time (not a runtime issue; Windows builds are not affected). The issue is fixed in sharp v0.30.5...

Sharp operating system command injection vulnerability

sharp is a program by the individual developers at lovell for converting large images in common formats into smaller, web-friendly JPEG, PNG, WebP, GIF and AVIF images of different sizes. An operating system command injection vulnerability exists in versions prior to sharp 0.30.5. An attacker can...

GHSA-H88F-R7CW-8FV3 Missing Authentication for Critical Function in Apache Airflow

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

org.jenkins-ci.main:jenkins-test-harness (1.525), org.jenkins-ci.main:jenkins-war (1.525) +5 more potentially affected by CVE-2021-21640 via org.jenkins-ci.main:jenkins-core (1.525)

org.jenkins-ci.main:jenkins-core MAVEN version 1.525 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.525 - org.jenkins-ci.main:jenkins-war 1.525 -...

qcubed PHP object injection

A PHP object injection bug in profile.php in qcubed all versions including 3.1.1 unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request...

chrome-launcher subject to OS Command Injection

chrome-launcher prior to 0.13.2 is subject to OS Command Injection via the $HOME environment variable in Linux operating systems. This issue is patched in version 0.13.2...

GHSA-GP2J-MG4W-2RH5 chrome-launcher subject to OS Command Injection

chrome-launcher prior to 0.13.2 is subject to OS Command Injection via the $HOME environment variable in Linux operating systems. This issue is patched in version 0.13.2...