elektro-light.hu Improper Access Control vulnerability OBB-3832437

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion

Description The plugin is vulnerable to unauthorized access & modification of data due to a missing capability check on the caARConnect function, allowing authenticated attackers, with subscriber-level access and above, to retrieve data from the plugin and save/delete entries...

WordPress canvasio3D Light Plugin <= 2.5.0 is vulnerable to Broken Access Control

Software canvasio3D Light Type Plugin Vulnerable versions = 2.5.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-48776 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID c7a418353e30 Credits Abdi Pranata Required...

CVE-2023-45955

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

CVE-2023-45955

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

CVE-2023-45955

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

Command injection

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

Nanoleaf Light strip security vulnerability

Nanoleaf Light strip is a smart LED strip from Nanoleaf. A security vulnerability exists in Nanoleaf Light strip version v3.5.10 that could allow an attacker to send a malicious message and cause a denial of service...

CVE-2023-45955

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

CVE-2023-45955

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

PT-2023-29772 · Nanoleaf · Nanoleaf Light Strip

Name of the Vulnerable Software and Affected Versions: Nanoleaf Light strip version 3.5.10 Description: An issue discovered in the Nanoleaf Light strip allows attackers to cause a denial of service via crafted write binding attribute commands. Recommendations: For version 3.5.10, consider disabli...

CVE-2023-45955: Uncontrolled Resource Consumption

An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands...

CVE-2023-45955

CVE-2023-45955 affects Nanoleaf Light strip v3.5.10, enabling a network-denial of service via crafted write binding attribute commands. Root cause specifics are not fully disclosed in the provided documents. PT-2023-29772 recommends temporarily disabling write binding attribute commands as a work...

Friday Squid Blogging: On the Ugliness of Squid Fishing

And seafood in general: A squid ship is a bustling, bright, messy place. The scene on deck looks like a mechanics garage where an oil change has gone terribly wrong. Scores of fishing lines extend into the water, each bearing specialized hooks operated by automated reels. When they pull a squid o...

light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

GHSA-MX47-H5FV-GHWH light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...