Tenda AC6 跨站脚本漏洞

The Tenda AC6 is a wireless router from Tenda, China. The Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50multi suffers from a cross-site scripting vulnerability, which stems from a cross-site scripting XSS vulnerability found in the deviceId parameter of the Parental Control module...

CVE-2023-33671

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function...

CVE-2022-45938

An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation...

CVE-2022-45938

An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation...

CVE-2022-45938

An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation...

CVE-2022-45938

An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation...

CVE-2023-33741

Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device...

CVE-2023-33741

Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device...

CVE-2023-31679

Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...

Improper access control

Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...

CVE-2023-31679

Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...

Cross-site Scripting (XSS)

Overview Jellyfin.Common is an a Free Software Media System that puts you in control of managing and streaming your media. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper escape of device id in raw HTML, which can be used to make arbitrary calls to the...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

GHSA-65V8-6PVW-JWVQ Answer vulnerable to Insertion of Sensitive Information Into Sent Data

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc...

Answer vulnerable to Insertion of Sensitive Information Into Sent Data

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc...

SUSE-SU-2023:1776-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2023-26604: Fixed a privilege escalation via the less pager. bsc1208958 - CVE-2022-4415: Fixed systemd-coredump that did not respect the fs.suiddumpable kernel setting bsc1205000. - CVE-2022-3821: Fixed buffer overrun in formattimespan...

PT-2023-2622 · Nexx · Nexx Garage Door Controller +3

Name of the Vulnerable Software and Affected Versions: Nexx Smart Home devices affected versions not specified Nexx Garage Door Controller NXG-100B, NXG-200 affected versions not specified Nexx Smart Plug NXPG-100W affected versions not specified Nexx Smart Alarm NXAL-100 affected versions not...

EXIF Geolocation Data Not Stripped From brand logo

When the user uploads his logo, the uploaded image’s EXIF Geo-location Data does not get stripped. As a result, anyone can get sensitive information like user's Device ID, Geo Location, System Information, System version, ETC. Step to reproduce: 1. Upload logo with EXIF DATA, or download from her...