lucie-f-zeven.e-monsite.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026700 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

PT-2019-4881

Name of the Vulnerable Software and Affected Versions GNU Bash versions 5.0 patch 11 and earlier Description An issue was discovered in the disable priv mode function in shell.c. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its...

CVE-2014-3875

The addto parameter to fup in Frams' Fast File EXchange FEX, aka fex before fex-2014053 allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2014-3875

The addto parameter to fup in Frams' Fast File EXchange FEX, aka fex before fex-2014053 allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2014-3875

The CVE-2014-3875 entry documents a cross-site scripting (XSS) vulnerability in Frams’ Fast File Exchange (F*EX, fex) prior to fex-2014053, where the addto parameter of fup can be exploited to inject HTML/headers. Debian DLA-68-1 confirms this issue and lists fixes for the fex package (versions a...

Unspecified Vulnerability in Blackview BV9000Pro-F

The Blackview BV9000Pro-F is a smartphone from Blackview of Hong Kong, China. A security vulnerability exists in the Blackview BV9000Pro-F build fingerprint: Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys in the com.mediatek. A security vulnerability exists in the...

CVE-2019-15420

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

Code injection

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15420

CVE-2019-15420 affects Blackview BV9000Pro-F (Android 7.1.1, build Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys). A pre-installed app com.mediatek.factorymode (version 1) enables unauthorized wireless settings modification via a confused deputy attack, accessible to...

CVE-2019-15420

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

PT-2019-14149

Name of the Vulnerable Software and Affected Versions Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys Description The issue concerns a pre-installed app with a package name of com.mediatek.factorymode tha...

CVE-2019-15420: Externally Controlled Reference to a Resource in Another Sphere

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

PT-2019-15722

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud EX2 Ultra firmware version 2.31.183 Description The issue allows remote execution of arbitrary code via a stack-based buffer overflow. This is possible due to the lack of size verification logic in one of the functions...

FlexAir Access Control 2.3.38 Command Injection

!/bin/bash Command injection with root privileges in FlexAir Access Control Prima Systems Firmware version: $OUTPUTFILE" Command injection payload. Be careful with single quotes! PAYLOAD="" Perform exploit echo "Executing: $CMD" curl --silent --output /dev/null -X POST -d "$PAYLOAD"...

CVE-2019-18786

In CVE-2019-18786, the Linux kernel up to version 5.3.8 contains an uninitialized f->fmt.sdr.reserved in rcar_drif_g_fmt_sdr_cap (drivers/media/platform/rcar_drif.c), enabling an information disclosure (memory disclosure) vulnerability. Connected advisories (Unity Nessus plugins) restate that ...

CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

PT-2019-14907 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue in FusionPBX allows unauthorized access to download files due to an unsanitized variable f coming from the URL in the file resourcesdownload.php. This enables an attacker to download an...

Tylium - Primary Data Pipelines For Intrusion Detection, Security Analytics And Threat Hunting

These files contain configuration for producing EDR endpoint detection and response data in addition to standard system logs. These configurations enable the production of these data streams using F/OSS free and / or open source tooling. The F/OSS tools consist of Auditd for Linux; Sysmon for...

driva-f Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-991856 Security Researcher Hchabik Helped patch 2461 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting driva-f website and its user...

CVE-2019-13921: Insufficient Resource Pool

A vulnerability has been identified in SIMATIC WinAC RTX F 2010 All versions SP3 Update 1. Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is...