CVE-2023-41898 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-44385

CVE-2023-44385 : Affects Home Assistant Companion for iOS and macOS up to version 2023.4. The vulnerability is a Client-Side Request Forgery that allows an attacker to lure a victim into visiting a malicious link or QR code, causing the victim to invoke arbitrary services on their Home Assistant ...

Home Assistant Security Breach

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security flaw in the component webhook that allows an attacker to...

Home Assistant Data Falsification Issue Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from Home assistant not setting the HTTP security header. An attacker can...

Home Assistant Cross-Site Scripting Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security hole in the login page. The vulnerability can be exploited...

Home Assistant Information Disclosure Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. An information disclosure vulnerability exists in Home Assistant versions prior to 2023.9.0, which stems from a vulnerability that allows an attacker to log in and...

PT-2023-28151 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The Home Assistant login page is affected by a Cross-site Scripting XSS issue. This occurs because the redirect uri validation does not properly check the scheme of URLs, allowing for...

Home Assistant Code Injection Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant versions prior to 2023.9.2 that stems from an arbitrary URL loading issue in WebView. An attacker can exploit the...

Home Assistant Companion Cross-Site Request Forgery Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7 that stems from the presence of a client request forgery vulnerability. An...

PT-2023-28153

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2023.9.0 Description The issue concerns the omission of HTTP security headers, including the X-Frame-Options header, in Home Assistant server. This omission facilitates covert clickjacking attacks and other...

PT-2023-29219 · Home Assistant · Home Assistant Companion

Name of the Vulnerable Software and Affected Versions: Home Assistant Companion for iOS and macOS versions up to 2023.4 Description: The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can...

Home Assistant Code Issue Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7, which stems from a Server Request Forgery SSRF vulnerability in the component...

PT-2023-28150 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The issue affects Home Assistant, an open-source home automation system. Webhooks in the webhook component can be triggered via the .ui.nabu.casa URL without authentication, even when...

Home Assistant Security Breach

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.8.0, which stems from a vulnerability that allows an attacker to create a malicious link...

PT-2023-28152 · Unknown · Home-Assistant-Js-Websocket +1

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2023.8.0 home-assistant-js-websocket versions prior to 8.2.0 Description: The issue concerns an open-source home automation system where the WebSocket authentication logic is vulnerable to exploitation...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

encorehomefurnishings.com Cross Site Scripting vulnerability OBB-3738364

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...