fortmorgancharterboats.vidmy.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1017093 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Design/Logic Flaw

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

thomka.meck.hu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-979218 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Atlassian JIRA < 8.4.0 SSRF

Binary data 701221.prm...

First American Financial Corp. Data Records Leak

Krebs on Security is reporting a massive data leak by the real estate title insurance company First American Financial Corp. "The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and eve...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability

The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...

CVE-2019-7611

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission...

Views (for Drupal 7) - Less critical - Cross site scripting - SA-CONTRIB-2019-036

This module enables you to create customized lists of data. The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that a view must display a field with the format "Full data serialized" and an...

CVE-2019-9023

Removed by vendor...

World Readable Data

tripleo-heat-templates contains a world readable data vulnerability. The library does not set the proper permissions during the creation of the ceph.client.openstack.keyring, allowing a local user to access the keyring to read or modify data. This vulnerability only affects setups with openstack...

The vulnerability of the Windows operating system, related to errors in processing fragmented IP packets by the stack, allows a hacker to disclose sensitive information that is protected.

The vulnerability of the Windows operating system is related to errors in processing fragmented IP packets. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information using specially crafted fragmented IP packets...

CVE-2018-20301

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints e.g., creating, editing, updating allow users to update any coherencefields data. For example, users can automatically confirm their accounts ...

WordPress <= 5.0 - PHP Object Injection via Meta Data vulnerability

PHP Object Injection via Meta Data vulnerability found by Sam Thomas in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...

Anker Nebula Capsule Pro Denial of Service Vulnerability

The Anker Nebula Capsule Pro is a projector device from Anker Innovations, USA. A security vulnerability exists in the Anker Nebula Capsule Pro NBUIM1V2.1.9 version. An attacker can exploit the vulnerability by sending data to the WifiService with the help of a specially crafted application to...

CVE-2018-18591

A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data...

CVE-2018-18591 MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data

A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data...

CVE-2018-18591

CVE-2018-18591 affects Micro Focus Service Manager versions 9.30 through 9.51 (as listed). The vulnerability is described as a potential unauthorized disclosure of data, which could be exploited to release confidential information. The provided connected sources confirm the affected software set ...

GoPro gpmf-parser denial of service vulnerability

GoPro gpmf-parser is a telemetry data parser in GPMF format for use in GoPro cameras. A security vulnerability exists in the 'GPMFScaledData' function of the GPMFparser.c file in GoPro gpmf-parser versions prior to 1.2.1. An attacker can exploit this vulnerability to cause a denial of service...

SSL Insecure Protocols

The remote server offers insecure SSL protocol version which can lead to vulnerability exploitation. No source data...

cgit cgit_clone_objects() Directory Traversal

cgit: directory traversal in cgitcloneobjects CVE-2018-14912 There is a directory traversal vulnerability in cgitcloneobjects, reachable when the configuration flag enable-http-clone is set to 1 default: void cgitcloneobjectsvoid if !ctx.qry.path cgitprinterrorpage400, "Bad request", "Bad request...