CVE-2022-36328: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, M...

CVE-2022-4418: Improper Verification of Cryptographic Signature

Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office Windows before build 40208...

Multiple Western Digital products have path traversal vulnerabilities

Western Digital My Cloud is a personal cloud storage device.Western Digital My Cloud Home is an easy-to-use personal cloud storage device.SanDisk ibi is a smart photo manager and media storage drive from SanDisk Corporation. SanDisk ibi and others are products of SanDisk Corporation.SanDisk ibi i...

CVE-2022-36326: Uncontrolled Resource Consumption

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi a...

CVE-2023-2775

A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reachcity leads to sql injection. It is possible to initiate the attack remotely. The...

Bus Dispatch and Information System SQL Injection Vulnerabilities

Bus Dispatch and Information System is a bus dispatch and information system. A SQL injection vulnerability exists in Bus Dispatch and Information System version 1.0, which stems from unknown functionality in adminHome.php that causes sql injection via the parameter reachcity...

Symcon IP-Symcon path traversal vulnerability

Symcon IP-Symcon is Symcon's complete solution for the home automation space. A security vulnerability exists in Symcon IP-Symcon versions prior to 6.3 that stems from allowing a remote attacker to read sensitive files via a URL in the... directory traversal sequence to read sensitive files...

HNAP1 Protocol Code Execution

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-2640-US router microprogramming software is related to the lack of measures to sanitize input data during the processing of the LocalIPAddress parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrar...

HNAP1 Protocol Code Execution

The vulnerability of the HNAP1 protocol implementation in D-Link DIR-2640-US router microprogramming software is related to the lack of measures to sanitize input data during the processing of the PrefixLen parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary cod...

D-Link DIR-2640-US HNAP1 Protocol Code Execution

The vulnerability of the HNAP1 protocol implementation in the D-Link DIR-2640-US router microprogramming system is related to insufficient validation of the string entered by the user before it is used to execute system calls when processing the DestNetwork parameter. Exploiting this vulnerabilit...

PT-2023-2918 · Mitel · Mitel Mivoice Connect

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice Connect versions through 19.3 SP2 Mitel MiVoice Connect versions 20.x Mitel MiVoice Connect versions 21.x Mitel MiVoice Connect versions 22.x through 22.24.1500.0 Description: The issue is related to insufficient validation for...

CVE-2023-2739

A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27" leads to cross site scripting. The attack can be initiated remotely. The...

Design/Logic Flaw

Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system...

home-restaurant.ch Cross Site Scripting vulnerability OBB-3343441

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

home-expedition.ch Cross Site Scripting vulnerability OBB-3343428

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

home-dry.ch Cross Site Scripting vulnerability OBB-3343425

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Missing permission check in email-ext

email-ext 2.96 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system. This form...

Teltonika Remote Management System Cross-site Scripting Vulnerability

Teltonika Remote Management System is a Teltonika Remote Management System used to manage Teltonika products. A cross-site scripting vulnerability exists in Teltonika Remote Management System versions prior to 4.10.0, which stems from the inclusion of a cross-site scripting XSS vulnerability in t...

CVE-2022-36329

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...

Input validation

An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before...