CVE-2023-30846 typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with...

CVE-2023-25402

CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload...

CVE-2023-25403

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...

PT-2023-20793 · Cleverstupiddog · Yf-Exam

Name of the Vulnerable Software and Affected Versions: CleverStupidDog yf-exam version 1.8.0 Description: The issue is related to Deserialization, which can lead to remote code execution RCE. Recommendations: For version 1.8.0, consider disabling deserialization functionality until a patch is...

PT-2023-20048 · Unknown · Cleverstupiddog Yf-Exam

Name of the Vulnerable Software and Affected Versions: CleverStupidDog yf-exam version 1.8.0 Description: The issue concerns a lack of restriction on the suffix of uploaded files, allowing any file to be uploaded. Recommendations: For version 1.8.0, restrict access to the file upload feature unti...

yf-exam 代码问题漏洞

yf-exam CloudFan Training Exam System is a training exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the lack of restriction on the suffix of uploaded files, resulting in an arbitrary file upload...

yf-exam 代码问题漏洞

yf-exam CloudFan Training and Exam System is a training and exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the presence of a deserialization vulnerability that can be exploited by an attacker to cau...

CVE-2023-26779

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution RCE...

CVE-2023-26780

CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection...

CleverStupidDog yf-exam SQL注入漏洞

yf-exam CloudFan Training Exam System is a training exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam v1.8.0, which stems from the presence of SQL injection...

CVE-2023-26780

CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection...

CVE-2023-1149 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0...

SUSE CVE-2018-8036

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted or fuzzed file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser...

WordPress Plugin WangGuard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports setting up personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability...

PT-2023-10628 · Unknown · Wangguard Plugin

Name of the Vulnerable Software and Affected Versions: WangGuard Plugin version 1.8.0 Description: A problematic issue has been found in the WangGuard Plugin, affecting the wangguard users info function of the wangguard-user-info.php file in the WGG User List Handler component. The manipulation o...

ALPINE-CVE-2023-22809

In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...

CVE-2023-22809

In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...

Cross site scripting

A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched...

CVE-2015-10025

A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and...

ep-3 Bookingsystem 跨站脚本漏洞

ep-3 Bookingsystem is an online booking system for courthouses by the individual developer Tobias Krebs. A cross-site scripting vulnerability exists in ep-3 Bookingsystem version 1.8.0, which stems from a portion of its code that allows an attacker to implement cross-site scripting...