Advisory - Payatu

Technical Advisory

Through sharp, technical and insightful analysis, the Payatu Team is constantly on the lookout for vulnerabilities and threats. This section exhibits a few of our findings.

TITLE:

XSS in admiror gallery 5.2.0

Report ID:

PS86

CVE-ID:

CVE-2023-38045

Reported On:

06/07/2023

Publish On:

TITLE:

SQL Injection in Hikeshop via data[order][payment] parameter verison < 4.7.3

Report ID:

PS85

CVE-ID:

CVE-2023-38044

Reported On:

06/07/2023

Publish On:

TITLE:

SQL injection in online virtual classroom via cid parameter

Report ID:

PS84

CVE-ID:

CVE-2023-34477

Reported On:

06/07/2023

Publish On:

TITLE:

SQL Injection in Proforms Basic via sort_order parameter

Report ID:

PS83

CVE-ID:

CVE-2023-34476

Reported On:

06/07/2023

Publish On:

TITLE:

SQL Injection in Creative Gallery via id parameter

Report ID:

PS82

CVE-ID:

CVE-2023-23758

Reported On:

06/07/2023

Publish On:

TITLE:

Unvalidated open redirection Fuge CMS v1.0

Report ID:

PS81

CVE-ID:

CVE-2023-34916

Reported On:

06/06/2023

Publish On:

TITLE:

Unvalidated redirection vulnerability in Fuge CMS v1.0

Report ID:

PS80

CVE-ID:

CVE-2023-34917

Reported On:

06/06/2023

Publish On:

TITLE:

Cross Site Scripting (XSS) vulnerability in username field in chatbox functionality in ChatEngine 1.0

Report ID:

PS79

CVE-ID:

CVE-2023-30326

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

SQL Injection vulnerability in textMessage field in ChatEngine 1.0

Report ID:

PS78

CVE-ID:

CVE-2023-30325

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

SQL Injection in chatWindow functionality in ChatEngine 1.0

Report ID:

PS77

CVE-ID:

CVE-2023-30323

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

Cross Site Scripting (XSS) in username field in chatWindow functionality in ChatEngine 1.0

Report ID:

PS76

CVE-ID:

CVE-2023-30322

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

Cross Site Scripting (XSS) textMessage field in Login functionality in ChatEngine 1.0

Report ID:

PS75

CVE-ID:

CVE-2023-30321

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

Cross Site Scripting (XSS) in textMessage field in ChatEngine 1.0

Report ID:

PS74

CVE-ID:

CVE-2023-30320

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

Cross Site Scripting (XSS) in username field in ChatEngine 1.0

Report ID:

PS73

CVE-ID:

CVE-2023-30319

Reported On:

01/04/2023

Publish On:

06/07/2023

TITLE:

Upload Resume <= 1.2.0 – Captcha Bypass

Report ID:

PS72

CVE-ID:

CVE-2023-2751

Reported On:

17/03/2023

Publish On:

24/05/2023

TITLE:

Stagtools < 2.3.7 – Contributor+ Stored XSS

Report ID:

PS71

CVE-ID:

CVE-2023-0891

Reported On:

11/02/2023

Publish On:

05/04/2023

TITLE:

IDURAR ERP/CRM NoSQL injection

Report ID:

PS70

CVE-ID:

CVE-2023-27742

Reported On:

28/02/2023

Publish On:

30/03/2023

TITLE:

FluentForms <= 4.3.22 Stored XSS via Custom HTML fields

Report ID:

PS69

CVE-ID:

CVE-2023-0546

Reported On:

24/01/2023

Publish On:

20/03/2023

TITLE:

AnyWhere Elementor <= 1.2.7 – Freemius API Key Disclosure

Report ID:

PS68

CVE-ID:

CVE-2023-0443

Reported On:

18/01/2023

Publish On:

02/05/2023

TITLE:

Elementor Website Builder <= 3.10.0 – Admin+ SQLi

Report ID:

PS67

CVE-ID:

CVE-2023-0329

Reported On:

20/01/2023

Publish On:

02/05/2023

TITLE:

WPCode <= 2.0.6 – Contributor+ WPCode.com Library Connection Modification

Report ID:

PS66

CVE-ID:

CVE-2023-0328

Reported On:

10/01/2023

Publish On:

09/02/2023

TITLE:

Siri(iPhone 8 and later) – Meeting/Event Disclosure on Locked iPhone

Report ID:

PS65

CVE-ID:

CVE-2022-32871

Reported On:

18/08/2022

Publish On:

03/01/2023

TITLE:

WP ALL Export Pro < 1.7.9 – Authenticated Code Injection

Report ID:

PS62

CVE-ID:

CVE-2022-3394

Reported On:

18/08/2022

Publish On:

03/01/2023

TITLE:

Import all XML, CSV & TXT into WordPress < 6.5.8 – Missing Authorisation

Report ID:

PS61

CVE-ID:

CVE-2022-3244

Reported On:

27/07/2022

Publish On:

20/09/2022

TITLE:

SQL injection in School Management System 1.0

Report ID:

PS57

CVE-ID:

CVE-2022-36193

Reported On:

05/08/2022

Publish On:

30/08/2022

TITLE:

FluentSMTP <= 2.2.2 Stored XSS via Email Logs

Report ID:

PS59

CVE-ID:

CVE-2023-0219

Reported On:

10/01/2023

Publish On:

20/02/2023

TITLE:

WP ALL Export Pro < 1.7.9 – Authenticated SQLi

Report ID:

PS63

CVE-ID:

CVE-2022-3395

Reported On:

18/08/2022

Publish On:

03/10/2022

TITLE:

Import all XML, CSV & TXT into WordPress < 6.5.8 – Admin+ SQLi

Report ID:

PS60

CVE-ID:

CVE-2022-3243

Reported On:

27/07/2022

Publish On:

20/09/2022

TITLE:

CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS)

Report ID:

PS58

CVE-ID:

CVE-2022-46087

Reported On:

25/11/2022

Publish On:

22/11/2022

TITLE:

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Report ID:

PS56

CVE-ID:

CVE-2022-40047

Reported On:

27/07/2022

Publish On:

28/09/2022

TITLE:

Remote code execution (RCE) via Upload File bypass in Flatpress 1.2.1

Report ID:

PS55

CVE-ID:

CVE-2022-40048

Reported On:

27/05/2022

Publish On:

27/09/2022

TITLE:

Drag and Drop Multiple File Upload < 1.3.6.5 – File Upload Size Limit Bypass

Report ID:

PS64

CVE-ID:

CVE-2022-3282

Reported On:

26/08/2022

Publish On:

23/09/2022

TITLE:

Command Injection in GitHub repository Nuitka/Nuitka prior to 0.9.

Report ID:

PS54

CVE-ID:

CVE-2022-2054

Reported On:

04/06/2022

Publish On:

05/06/2022

TITLE:

Privilege Escalation in Konga v0.14.9

Report ID:

PS53

CVE-ID:

CVE-2021-42192

Reported On:

16/10/2022

Publish On:

04/05/2022

TITLE:

Code Injection in pytorch-lightning prior to 1.6.0

Report ID:

PS52

CVE-ID:

CVE-2022-0845

Reported On:

03/03/2022

Publish On:

04/03/2022

TITLE:

Lack of Bluetooth LE pairing and access control in Fastrack reflex 2.0 activity tracker

Report ID:

PS51

CVE-ID:

CVE-2021-35952

Reported On:

17/11/2020

Publish On:

30/06/2021

TITLE:

Unauthenticated Firmware Update in Fastrack Reflex 2.0 Activity Tracker

Report ID:

PS48

CVE-ID:

CVE-2021-35951

Reported On:

17/11/2020

Publish On:

30/06/2021

TITLE:

Denial of service (Device Crashing) on Fastrack reflex 2.0 activity tracker

Report ID:

PS49

CVE-ID:

CVE-2021-35953

Reported On:

17/11/2020

Publish On:

30/06/2021

TITLE:

Open Serial debug port Allows Dumping, and re- flashing Firmware in Fastrack reflex 2.0 activity tracker

Report ID:

PS50

CVE-ID:

CVE-2021-35954

Reported On:

17/11/2020

Publish On:

30/06/2021

TITLE:

DoS in aedes MQTT broker

Report ID:

PS34

CVE-ID:

CVE-2020-13410

Reported On:

18/05/2020

Publish On:

22/05/2020

TITLE:

Safari Login AutoFill

Report ID:

PS35

CVE-ID:

CVE-2020-9903

Reported On:

22/03/2020

Publish On:

15/07/2020

TITLE:

Safari reader download permission bypass

Report ID:

PS36

CVE-ID:

CVE-2020-9912

Reported On:

19/04/2020

Publish On:

15/07/2020

TITLE:

Safari reader same origin policy (SOP) bypass

Report ID:

PS37

CVE-ID:

CVE-2020-9911

Reported On:

19/04/2020

Publish On:

15/07/2020

TITLE:

Safari Address Bar Spoof

Report ID:

PS28

CVE-ID:

CVE-2020-3833

Reported On:

11/10/2019

Publish On:

29/01/2020

TITLE:

massCode Code execution

Report ID:

PS29

CVE-ID:

CVE-2020-8548

Reported On:

01/02/2020

Publish On:

04/02/2020

TITLE:

Reflected XSS in GTranslate wordpress plugin

Report ID:

PS30

CVE-ID:

CVE-2020-11930

Reported On:

10/02/2019

Publish On:

18/03/2020

TITLE:

WebKit – AXObjectCache – m_deferredFocusedNodeChange – UaF

Report ID:

PS31

CVE-ID:

CVE-2020-10018

Reported On:

19/11/2019

Publish On:

12/03/2020

TITLE:

Apache Artemis – XSS Over MQTT

Report ID:

PS38

CVE-ID:

CVE-2020-13932

Reported On:

20/05/2020

Publish On:

20/07/2020

TITLE:

Lack of Medical data encryption and integrity in Niscomed Multipara Patient Monitor

Report ID:

PS39

CVE-ID:

CVE-2020-15484

Reported On:

22/06/2020

Publish On:

22/07/2020

TITLE:

Unauthenticated telnet service in niscomed patient Monitor

Report ID:

PS40

CVE-ID:

CVE-2020-15482

Reported On:

22/06/2020

Publish On:

22/07/2020

TITLE:

Unautenticated UART port in niscomed patient monitoring device

Report ID:

PS41

CVE-ID:

CVE-2020-15483

Reported On:

22/06/2020

Publish On:

22/07/2020

TITLE:

Lack of Medical data encryption in Dr.Trust ECG/EKG Pen

Report ID:

PS42

CVE-ID:

CVE-2020-15485

Reported On:

22/06/2020

Publish On:

22/07/2020

TITLE:

Lack of Bluetooth LE pairing and access control in Dr.Trust ECG/EKG Pen

Report ID:

PS43

CVE-ID:

CVE-2020-15486

Reported On:

22/06/2020

Publish On:

22/07/2020

TITLE:

HiveMQ MQTT broker – XSS Over MQTT

Report ID:

PS44

CVE-ID:

CVE-2020-13821

Reported On:

18/05/2020

Publish On:

25/08/2020

TITLE:

CSRF leads to pages deletion

Report ID:

PS45

CVE-ID:

CVE-2020-25263

Reported On:

20/06/2020

Publish On:

10/10/2020

TITLE:

CSRF leads to pages deletion

Report ID:

PS46

CVE-ID:

CVE-2020-25262

Reported On:

20/06/2020

Publish On:

10/10/2020

TITLE:

Remote Code Execution In JsonPickle Python Module

Report ID:

PS47

CVE-ID:

CVE-2021-35951

Reported On:

13/08/2020

Publish On:

17/12/2020

TITLE:

Safari video permission spoof

Report ID:

PS32

CVE-ID:

CVE-2020-9781

Reported On:

05/08/2019

Publish On:

25/03/2020

TITLE:

Trendnet wireless camera buffer overflow vulneribility

Report ID:

PS33

CVE-ID:

CVE-2020-12763

Reported On:

13/01/2020

Publish On:

11/05/2020

TITLE:

Firefox IOS QR Code Reader XSS

Report ID:

PS27

CVE-ID:

CVE-2019-17003

Reported On:

18/07/2019

Publish On:

10/12/2019

TITLE:

Microsoft Edge Elevation of Privilege Vulnerability

Report ID:

PS26

CVE-ID:

CVE-2019-0678

Reported On:

28/11/2018

Publish On:

03/12/2019

TITLE:

CVE-2014-8446 – Adobe Acrobat/Reader – Memory Corruption

Report ID:

PS1

CVE-ID:

CVE-2014-8446

Reported On:

15/05/2014

Publish On:

09/12/2014

TITLE:

Hardcoded AES 256 bit key used in Kankun Smart socket and its mobile App

Report ID:

PS2

CVE-ID:

CVE-2015-4080

Reported On:

25/05/2015

Publish On:

05/06/2015

TITLE:

Microsoft Internet Explorer CDOMStringDataList::InitFromString Out-Of-Bounds Indexing Information Disclosure Vulnerability

Report ID:

PS3

CVE-ID:

CVE-2015-6086

Reported On:

08/09/2015

Publish On:

10/12/2015

TITLE:

Adobe Reader Type Confusion – Memory Corruption Vulnerability

Report ID:

PS4

CVE-ID:

CVE-2017-3038

Reported On:

05/12/2016

Publish On:

06/04/2016

TITLE:

Memory Corruption Mach-O 1

Report ID:

PS6

CVE-ID:

CVE-2017-8774

Reported On:

25/06/2016

Publish On:

11/07/2016

TITLE:

OOB Write Heap Buffer dwCompressionSize MS-WIM

Report ID:

PS7

CVE-ID:

CVE-2017-8773

Reported On:

13/07/2016

Publish On:

20/07/2016

TITLE:

OOB Write Stack Buffer LC_UNIXTHREAD.cmdsize Mach-O

Report ID:

PS5

CVE-ID:

CVE-2017-5005

Reported On:

09/06/2016

Publish On:

11/06/2016

TITLE:

Insecure Libray Loading

Report ID:

PS8

CVE-ID:

CVE-2017-8776

Reported On:

09/06/2016

Publish On:

01/08/2016

TITLE:

Non-ASLR & DEP Modules

Report ID:

PS9

CVE-ID:

CVE-2017-8776

Reported On:

09/06/2016

Publish On:

01/08/2016

TITLE:

Memory Corruption Mach-O 2

Report ID:

PS10

CVE-ID:

CVE-2017-8775

Reported On:

25/06/2016

Publish On:

05/08/2016

TITLE:

Foxit Reader PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Report ID:

PS11

CVE-ID:

CVE-2017-8454

Reported On:

03/01/2017

Publish On:

09/03/2017

TITLE:

Foxit Reader – Uninitialized Memory – Arbitrary Write Vulnerability

Report ID:

PS13

CVE-ID:

CVE-2017-8453

Reported On:

03/01/2017

Publish On:

09/03/2017

TITLE:

Foxit Reader – Uninitialized Memory – Arbitrary Write Vulnerability

Report ID:

PS14

CVE-ID:

CVE-2017-8455

Reported On:

22/02/2017

Publish On:

09/03/2017

TITLE:

Foxit Reader PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Report ID:

PS18

CVE-ID:

CVE-2017-10943

Reported On:

18/05/2017

Publish On:

07/07/2017

TITLE:

Foxit Reader PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Report ID:

PS19

CVE-ID:

CVE-2018-9950

Reported On:

19/01/2018

Publish On:

20/04/2018

TITLE:

Foxit Reader – Uninitialized Memory – Arbitrary Write Vulnerability

Report ID:

PS15

CVE-ID:

CVE-2017-10942

Reported On:

18/05/2017

Publish On:

07/07/2017

TITLE:

Foxit Reader CPDF_Object Use-After-Free Remote Code Execution Vulnerability

Report ID:

PS20

CVE-ID:

CVE-2018-9951

Reported On:

19/01/2018

Publish On:

20/04/2018

TITLE:

Foxit Reader PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Report ID:

PS17

CVE-ID:

CVE-2017-10944

Reported On:

01/06/2017

Publish On:

07/07/2017

TITLE:

Adobe Acrobat Reader Heap Overflow Remote Code Execution Vulnerability

Report ID:

PS21

CVE-ID:

CVE-2018-12798

Reported On:

08/01/2018

Publish On:

10/07/2018

TITLE:

Foxit Reader – CPDF_Parser::m_pCryptoHandler – Use After Free – RCE

Report ID:

PS23

CVE-ID:

CVE-2018-14442

Reported On:

08/01/2018

Publish On:

16/08/2018

TITLE:

Opera Mini Location Permission Spoof

Report ID:

PS24

CVE-ID:

CVE-2018-16135

Reported On:

02/08/2018

Publish On:

18/08/2018

TITLE:

Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability

Report ID:

PS25

CVE-ID:

CVE-2018-15968

Reported On:

08/01/2018

Publish On:

01/10/2018

TITLE:

jscript.dll – ActiveXObject BSTR – Use After Free

Report ID:

PS22

CVE-ID:

CVE-2018-8389

Reported On:

09/01/2018

Publish On:

14/08/2018