CVE-2021-32481

CVE-2021-32481 affects Cloudera Hue 4.6.0 and enables Cross-Site Scripting via the type parameter. The vulnerability is documented across multiple sources (NVD entry with CVSS v3.1 base score 6.1, CVSS v2.0 base score 4.3) indicating a network-exposed flaw with user interaction required in the 3....

PT-2021-19720

Name of the Vulnerable Software and Affected Versions: Cloudera Hue version 4.6.0 Description: The issue allows for a cross-site scripting XSS attack via the type parameter. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the page...

PT-2021-18560

Name of the Vulnerable Software and Affected Versions Cloudera Hue version 4.6.0 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take control of the...

Cloudera Hue cross-site scripting vulnerability

Cloudera Hue is a mature open source SQL helper for querying any database and data warehouse.A cross-site scripting vulnerability exists in Cloudera Hue version 4.6.0. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via the type parameter...

CVE-2021-32481: Improper Neutralization of Input During Web Page Generation

Cloudera Hue 4.6.0 allows XSS via the type parameter...

Cloudera Hue cross-site scripting vulnerability

Cloudera Hue is a full-fledged open source SQL helper for querying any database and data repository.A cross-site scripting vulnerability exists in Cloudera Hue version 4.6.0. An attacker could use the vulnerability to obtain administrator cookies, etc...

CVE-2021-29060

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string...

GHSA-FRPW-JRWX-HCFV Path Traversal in node-red-contrib-huemagic

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

Three Resource Management Error Vulnerability

Mrdoob Three is an application by the individual developers of Mrdoob USA. It provides the ability to create a scene, a camera and a geometric cube, and add that cube to the scene. A security vulnerability exists in Three. The vulnerability stems from the handling of rgb and hsl colors. The...

CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

PT-2021-16821 · Node Red · Node-Red-Contrib-Huemagic

Name of the Vulnerable Software and Affected Versions: node-red-contrib-huemagic version 3.0.0 Description: The issue allows for Directory Traversal, enabling access to arbitrary files. This is achieved through the res.sendFile API in the file hue-magic.js, using the hue/assets/..%2F path...

CVE-2021-25864: Improper Limitation of a Pathname to a Restricted Directory

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

Philips Hue Denial Of Service Vulnerability

Credits: Ilia Shnaidman + @0x496c on Twitter + https://www.iliashn.com Vendor: ============= Philips Lighting Holding B.V Product: ============= Philips Hue Hub - all Vulnerability Type: ====================== Denial of Service Security Issue: =============== Philips Hue is vulnerable to Denial...

Philips Hue Denial Of Service

Credits: Ilia Shnaidman + @0x496c on Twitter + https://www.iliashn.com Vendor: ============= Philips Lighting Holding B.V Product: ============= Philips Hue Hub - all Vulnerability Type: ====================== Denial of Service Security Issue: =============== Philips Hue is vulnerable to Denial...

CVE-2018-7580

Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of...

Design/Logic Flaw

Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of...