LDAP Injection

github.com/stevenweathers/thunderdome-planning-poker is vulnerable to LDAP injection. Lack of an escape filter allows remote attackers to inject specially crafted values through UserName parameter resulting in LDAP injection vulnerability. Successful attackers are able to read, modify or delete...

XML External Entity (XXE)

symphonycms/symphony-2 is vulnerable XML External Entity XXE. The vulnerability exists due to lack of disabling external entity in the function convertFromXMLString of symphony\lib\toolkit\class.xmlelement.php...

CVE-2021-3900

firefly-iii is vulnerable to Cross-Site Request Forgery CSRF...

Denial Of Service (DoS)

github.com/ethereum/go-ethereum is vulnerable to denial of service. An attacker is able to exploit the vulnerability by sending a maliciously crafted request, causing the system to crash...

exploitdb

This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. The Exploit Database is a...

Simple Online College Entrance Exam System 1.0 - SQL Injection Authentication Bypass Vulnerability

Exploit Title: Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass Exploit Author: Mevlüt Yılmaz Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html Software Link:...

Online Traffic Offense Management System 1.0 - Multiple SQL Injection Vulnerability

Exploit Title: Online Traffic Offense Management System 1.0 - Multiple SQL Injection Unauthenticated Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://www.sourcecodester.com Software Link:...

PT-2021-22110 · Boston Scientific · Zoom Latitude +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns the presence of unpatched vulnerabilities in off-the-shelf software components used by the affected device. A malicious attacker with physical access to the devic...

Denial Of Service (DoS)

vim is vulnerable to denial of service due to use after free...

Denial Of Service (DoS)

vim is vulnerable denial of service. The vulnerability exists due to a Heap-based Buffer Overflow...

GHSA-F263-C949-W85G Improper Authorization in Google OAuth Client

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...

Remote Code Execution (RCE)

@asyncapi/modelina is vulnerable to Arbitrary Code Injection. The vulnerability is due to a lack of proper checking of user supplied input in the TypeScriptGenerator function which allows an attacker to upload and execute malicious code...

Cross-Site Request Forgery (CSRF)

apache2 is vulnerable to cross-site request forgery. An attacker may exploit the vulnerability by sending a crafted request uri-path that can cause modproxy to forward the request to an origin server choosen by the remote user...

PT-2021-10551 · Suse · Suse

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific issue, as it refers to a duplicate candidate that has been removed to prevent accidental usage. It mentions...

PT-2021-10550 · Suse · Suse

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific issue, as it refers to a duplicate candidate that has been removed to prevent accidental usage. It mentions...

Denial Of Service (DoS)

libde265.so is vulnerable to denial of service. An attacker is able to send malicious input to the putweightedpredavg16fallback function to cause a heap buffer overflow...

Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

✍️ Description Accept Bitcoin payments. Free, open-source & self-hosted, Bitcoin payment processor this package is vulnerable for xss 🕵️‍♂️ Proof of Concept 💥 Impact This vulnerability is capable of stored XSS...

The vulnerability of the microprogrammed software for power meters and energy counters from PowerLogic models ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000, PM800 lies in the lack of protection for transmitted data. This allows unauthorized individuals to gain unauthorized access to the protected information.

The vulnerability of the microprogrammed software for PowerLogic power meters and energy counters, such as ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000, and PM800, stems from the lack of protection for transmitted data. Exploiting this vulnerability can allow an unauthorize...

Nested Pages < 3.1.16 - Open Redirect

The plugin was vulnerable to an Open Redirect via the page POST parameter in the npBulkActions, npBulkEdit, npListingSort, and npCategoryFilter adminpost actions...

Cross-Site Request Forgery (CSRF)

grumpydictator/firefly-iii is vulnerable cross-site request forgery. An attacker who knows the IP address or hostname of the application running on localhost or anywhere can remove budgeted amount if the user is logged in and visited a malicious website...