Frigate Cross-Site Request Forgery Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site request forgery vulnerability exists in Frigate versions prior to 0.13.0 Beta 3, which stems from a cross-site request forgery CSRF vulnerability in t...

Frigate Code Issue Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection by Blake Blackshear Personal Developer. A code issue vulnerability exists in versions prior to Frigate 0.13.0 Beta 3 that stems from the presence of an insecure deserialization vulnerability that could lead to...

CVE-2023-46394

A stored cross-site scripting XSS vulnerability in /home/user/editsubmit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter...

CVE-2023-5570

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12...

CVE-2023-5570

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting.This issue affects Home Manager Gateway: before v.1.27.12...

Input validation

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting.This issue affects Home Manager Gateway: before v.1.27.12...

CVE-2023-5570 User Enumeration in Inohom's Home Manager Gateway

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12...

CVE-2023-5570

The CVE-2023-5570 issue affects Inohom Home Manager Gateway (before v1.27.12). It is caused by improper protection for outbound error messages and alert signals, enabling account footprinting via leaked error information. The NVD/NVD-derived metrics list a CVSSv3.1 base score of 7.5 (High) with N...

CVE-2023-5570 User Enumeration in Inohom's Home Manager Gateway

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12...

CVE-2023-5570: Improper Protection for Outbound Error Messages and Alert Signals

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12...

PT-2023-32183

Name of the Vulnerable Software and Affected Versions Inohom Home Manager Gateway versions prior to 1.27.12 Description The issue affects Inohom Home Manager Gateway, allowing Account Footprinting due to an Improper Protection for Outbound Error Messages and Alert Signals vulnerability...

Synapse ACL DoS

The vulnerability of the Access Control List ACL management mechanism in the Synapse home server is related to the unrestricted and unregulated distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

D-Link DIR-3040 prog.cgi Code Execution

The vulnerability of the prog.cgi component in D-Link DIR-3040 wireless router software lies in the fact that the operation’s output escapes the buffer and is stored in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted HNAP...

GHSA-QHHJ-7HRC-GQJ5 Home Assistant vulnerable to account takeover via auth_callback login

Part of the Cure53 security audit of Home Assistant. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

Home Assistant vulnerable to account takeover via auth_callback login

Part of the Cure53 security audit of Home Assistant. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

PT-2023-28611 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.1 iPadOS versions prior to 17.1 macOS Ventura versions prior to 13.6.3 macOS Sonoma versions prior to 14.1 macOS Monterey versions prior to 12.7.2 Description: A logic issue was addressed with improved checks, which...

CLSA-2023-1697816385 curl: Fix of 2 CVEs

CVE-2022-27782: check additional TLS or SSH connection parameters that should have prohibited connection reuse - CVE-2023-27534: fix SFTP path '' resolving discrepancy - fix read off end of array for SCP home directory case...

Cross Site Scripting (XSS)

home-assistant/core and home-assistant-js-websocket are vulnerable to XSS attack.The vulnerability occurs due to a loophole in Websocket authentication logic. The logic utilises a state parameter which contains hassurl. This mechanism enables attackers to spoof websocket responses and trigger XSS...

Clickjacking

home-assistant is vulnerable to Clickjacking attacks. The server doesn't set the X-Frame-Options HTTP security headers . The omission of this header facilitates clickjacking attack which could also lead to RCE...

Cross Site Scripting (XSS)

Home assistant is vulnerable to Cross Site Scripting. The vulnerability is due to improper input validation on the Home Assistant administration page. This can be exploited by the attacker by using javascript: scheme URIs and executing malicious JS in the webpage...