andrew

8 exploits Active since Mar 2011
CVE-2021-23518 WRITEUP HIGH WRITEUP
cached-path-relative < 1.1.0 - Prototype Pollution via Cache Variable
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
CVSS 7.3
CVE-2023-49795 WRITEUP MEDIUM WRITEUP
MindsDB < 23.11.4.1 - Server-Side Request Forgery in file.py
MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.
CVSS 6.5
CVE-2023-49796 WRITEUP MEDIUM WRITEUP
mindsdb < 23.11.4.1 - Limited File Write via file.py
MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.
CVSS 5.3
CVE-2024-22779 WRITEUP HIGH WRITEUP
Kihron ServerRPExposer <1.0.2 - RCE
Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in ServerResourcePackProviderMixin.java.
CVSS 8.8
EIP-2026-115825 EXPLOITDB text WRITEUP
Microsoft Windows XP/2000 - Fontview Denial of Service
EIP-2026-115738 EXPLOITDB text SUSPICIOUS
Microsoft Mspaint - '.bmp' Crash (PoC)
CVE-2011-1106 EXPLOITDB text WORKING POC
IBM Lotus Sametime - Stored Cross-Site Scripting via stcenter.nsf authReasonCode Parameter
Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action.
CVE-2015-8617 EXPLOITDB CRITICAL text WORKING POC
PHP 7.x < 7.0.1 - Remote Code Execution via Format String Specifiers in Class Name
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
CVSS 9.8