Home Assistant Code Injection Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant versions prior to 2023.9.2 that stems from an arbitrary URL loading issue in WebView. An attacker can exploit the...

CVE-2023-41896: Insufficient Verification of Data Authenticity

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

CVE-2023-41899: Server-Side Request Forgery (SSRF)

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

CVE-2023-41895: Improper Neutralization of Input During Web Page Generation

Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the redirecturi and clientid parameters. Although the redirecturi validation typically ensures that it matches th...

CVE-2023-41897: Improper Restriction of Rendered UI Layers or Frames

Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks...

CVE-2023-44385: Cross-Site Request Forgery (CSRF)

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

Malware in onno-missing-2023-full-movies-at-home-streamnig

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

encorehomefurnishings.com Cross Site Scripting vulnerability OBB-3738364

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Acronis Cyber Protect Home Office Unauthorized Access

The vulnerability of the Acronis Cyber Protect Home Office backup and recovery software is related to errors in the use of standard permissions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Acronis Cyber Protect Home Office Privilege Escalation

The vulnerability of the Acronis Cyber Protect Home Office backup and recovery software is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

D-Link DIR-3040 Code Execution

The vulnerability of the SetWan2Settings function in D-Link DIR-3040 wireless router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HNAP...

Acronis Cyber Protect Home Office Improper Link Handling

The vulnerability of the Acronis Cyber Protect Home Office backup and recovery software lies in the improper handling of links before accessing files. Exploiting this vulnerability can allow attackers to enhance their privileges...

Acronis Cyber Protect Home Office Link Processing

The vulnerability of the Acronis Cyber Protect Home Office backup and recovery software is related to errors in handling links. Exploiting this vulnerability can allow attackers to enhance their privileges...

RiteCMS Cross-Site Scripting Vulnerability (CNVD-2026-05347)

RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the Home Page field, which can be exploited by an attacker to execute arbitrary Web...

Android TV Boxes Infected with Backdoors, Compromising Home Networks

By Waqas The Android TV box you recently purchased may be riddled with harmful backdoors. This is a post from HackRead.com Read the original post: Android TV Boxes Infected with Backdoors, Compromising Home Networks...

CVE-2023-43877

Rite CMS 3.0 has Multiple Cross-Site scripting XSS vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu...

CVE-2023-43877

Rite CMS 3.0 has Multiple Cross-Site scripting XSS vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu...

CVE-2023-44208

Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office Windows before build 40713, Acronis True Image OEM Windows before build 42575...

CVE-2023-44208

Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office Windows before build 40713, Acronis True Image OEM Windows before build 42575...