3681 matches found
h-m-u.de Improper Access Control vulnerability OBB-2218704
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-37254
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server...
Design/Logic Flaw
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server...
CVE-2021-37254
CVE-2021-37254 affects M-Files Web prior to 20.10.9524.1 and 20.10.9445.0. A remote attacker could obtain unauthenticated access to license key information for third‑party components stored on the server. Root cause and exact exploitation details are not provided in the documents. No remediation ...
CVE-2021-37254
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server...
CVE-2021-37254: Undefined Security Weakness
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server...
M-Files Web 授权问题漏洞
M-Files Corporation M-Files Web is an intelligent information management platform from M-Files Corporation, USA. M-Files Web is an intelligent information management platform from M-Files Corporation, Inc. that is used to optimally support users in their daily work. A security vulnerability exist...
CVE-2021-40765
Adobe Character Animator version 4.4 and earlier is affected by a memory corruption vulnerability when parsing a M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...
CVE-2020-21504: Improper Neutralization of Input During Web Page Generation
waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...
CVE-2020-21503: Exposure of Resource to Wrong Sphere
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free...
m-audio.com Cross Site Scripting vulnerability OBB-2152152
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Enbra Ewm Data Forgery Issue Vulnerability
Enbra Ewm is a universal reading device from the Czech company Enbra. It uses a radio to read water meters, heating cost indicators and heat meters. Enbra EWM is vulnerable to a data forgery issue in version 1.7.29, which stems from the fact that the software does not check for or detect replay...
Enbra Ewm Trust Management Issue Vulnerability
Enbra Ewm is a universal reading device from the Czech company Enbra. It uses radios to read water meters, heating cost indicators and heat meters. Enbra EWM is vulnerable to a trust management issue, which stems from multiple wireless M-Bus devices from Enbra using hard-coded credentials in secu...
Enbra EWM Access Control Error Vulnerability
Enbra Ewm is a universal reading device from the Czech company Enbra. It uses a radio to read water meters, heating cost indicators and calorimeters. An access control error vulnerability exists in Enbra EWM version 1.7.29, which originates in Enbra EWM and several tested wireless M-Bus sensors,...
DDoS Chart Toppers—BPS, PPS and RPS Greatest Hits
New to the scene, monster-sized botnet Mēris is raising some eyebrows with giant requests per second rps attacks as shared by Cloudflare 17.2M rps, reported August 19, Yandex peaking at 21.8M rps on September 5, and KrebsOnSecurity 2M rps on September 9. Some commentary came in on Slashdot, The...
CVE-2021-34571
Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...
CVE-2021-34573
In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...
CVE-2021-34573
In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events...
CVE-2021-34572
Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data...
Code injection
Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data...