24 matches found
CVE-2026-10660
creationtimestamp| type| source ---|---|--- 2026-07-11 17:28:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqf6sm6c6o2f 2026-07-11 19:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqffoyschb2q...
CVE-2026-10660
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bapbroadcastassistant.c reassembled remote Broadcast Receive State data into a single file-static netbufsimple attbuf, BTATTMAXATTRIBUTELEN = 512 bytes shared by all connection instances, while the BUSY flag, long-read...
CVE-2026-10660 Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bapbroadcastassistant.c reassembled remote Broadcast Receive State data into a single file-static netbufsimple attbuf, BTATTMAXATTRIBUTELEN = 512 bytes shared by all connection instances, while the BUSY flag, long-read...
CVE-2026-10660
The CVE-2026-10660 issue affects the Zephyr Bluetooth BAP Broadcast Assistant GATT client (subsys/bluetooth/audio/bap_broadcast_assistant.c). A single static net_buf_simple buffer (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512) is shared across all connections; per-connection state (BUSY flag, long-rea...
CVE-2019-10660
creationtimestamp| type| source ---|---|--- 2026-07-08 13:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5ahbcwux2s...
CVE-2025-10660 WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id
The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
WordPress WP Dashboard Chat plugin <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id vulnerability
Authenticated Contributor+ SQL Injection via id vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Dashboard Chat versions = 1.0.3...
CVE-2019-10660
Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...
CVE-2024-10660 ESAFENET CDG HookService.java deleteHook sql injection
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function deleteHook of the file /com/esafenet/servlet/policy/HookService.java. The manipulation of the argument hookId leads to sql injection. It is possible to initiate the attack remotely. The explo...
Vault Auth Groups Not Removed In Certain Circumstances
Summary A vulnerability was identified in Vault and Vault Enterprise “Vault” such that, under certain circumstances, an Entity’s Group membership may inadvertently include external Groups the Entity no longer has permissions to. This vulnerability, CVE-2020-10660, affects Vault and Vault Enterpri...
CVE-2020-10660
The CVE-2020-10660 issue affects HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3, where an Entity’s Group membership could inadvertently include Groups the Entity no longer has permissions to. The root cause is a mismanagement of group associations, enabling a bypass of access c...
CVE-2019-10660
The CVE-2019-10660 affects Grandstream GXV3611IR_HD devices, documented as vulnerable before firmware 1.0.3.23. A remote attacker with authentication can execute arbitrary code by supplying shell metacharacters in the logserver field of the /goform/systemlog API. The issue is a remote code execut...
CVE-2019-10660
Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...
CVE-2017-10660
CVE-2017-10660 is rejected/not used and does not represent an active vulnerability entry.
Axis Network Camera Remote Command Execution Exploit
This Metasploit module exploits an authentication bypass in .srv functionality and a command injection in parhand to execute code as the root user. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModul...
CVE-2018-10660
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection...
CVE-2018-10660
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection...
CVE-2018-10660
CVE-2018-10660 affects Axis Network Cameras. The connected sources confirm a shell command injection vulnerability in multiple Axis IP Camera models, enabling unauthenticated remote command execution through the .srv-to-parhand flow in the device’s UI/API, potentially giving root/system-level acc...