CVE-2023-41894: Incorrect Resource Transfer Between Spheres

Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the .ui.nabu.casa URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the...

CVE-2023-41899: Server-Side Request Forgery (SSRF)

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2023-44385: Cross-Site Request Forgery (CSRF)

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

PT-2023-28152 · Unknown · Home-Assistant-Js-Websocket +1

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2023.8.0 home-assistant-js-websocket versions prior to 8.2.0 Description: The issue concerns an open-source home automation system where the WebSocket authentication logic is vulnerable to exploitation...

Home Assistant Security Breach

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.8.0, which stems from a vulnerability that allows an attacker to create a malicious link...

CVE-2023-41896: Insufficient Verification of Data Authenticity

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

CVE-2023-24385

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

CVE-2023-24385

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

Cross site scripting

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

CVE-2023-24385 WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

CVE-2023-24385 WordPress Media Library Assistant Plugin <= 3.11 is vulnerable to Cross Site Scripting (XSS)

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

CVE-2023-24385

CVE-2023-24385 affects the WordPress Med ia Library Assistant plugin (author+ stored XSS) up to version 3.11. Root cause: insufficient escaping/validation of input leading to stored XSS when an authenticated user with author role submits data. Impact: stored cross-site scripting potential; can af...

LG LED Assistant Detection

Binary data lgledassistantdetect.nbin...

WordPress Plugin Media Library Assistant Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

LG LED Assistant Path Traversal (CVE-2023-4613)

Binary data lgledassistantcve-2023-4613.nbin...

CVE-2023-24385: Improper Neutralization of Input During Web Page Generation

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in David Lingren Media Library Assistant plugin = 3.11 versions...

CVE-2023-45063

Cross-Site Request Forgery CSRF vulnerability in ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin = 1.1.5 versions...

CVE-2023-45063

Cross-Site Request Forgery CSRF vulnerability in ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin = 1.1.5 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin = 1.1.5 versions...

CVE-2023-45063 WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin = 1.1.5 versions...