390 matches found
r3.org.uk Cross Site Scripting vulnerability OBB-2338644
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Path traversal
A vulnerability has been identified in Siveillance Video DLNA Server 2019 R1, Siveillance Video DLNA Server 2019 R2, Siveillance Video DLNA Server 2019 R3, Siveillance Video DLNA Server 2020 R1, Siveillance Video DLNA Server 2020 R2, Siveillance Video DLNA Server 2020 R3, Siveillance Video DLNA...
CVE-2020-25755
An issue was discovered on Enphase Envoy R3.x and D4.x and other current devices. The upgradestart function in /installer/upgradestart allows remote authenticated users to execute arbitrary commands via the force parameter...
CVE-2020-25753
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...
CVE-2020-25755
CVE-2020-25755 affects Enphase Envoy R3.x, D4.x (and other current devices). The issue is in the upgrade_start function (in /installer/upgrade_start), which allows remote authenticated users to execute arbitrary commands via the force parameter. Impact is described as remote command execution wit...
CVE-2020-25753
The CVE-2020-25753 entry concerns Enphase Envoy R3.x and D4.x devices running v3 software. The issue arises from a default admin password set to the last 6 digits of the serial number, and the serial number is retrievable by an unauthenticated user at /info.xml. This combination creates a credent...
CVE-2020-25752
The CVE-2020-25752 entry concerns Enphase Envoy R3.x and D4.x devices with hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords are derived from the MD5 hash of the username and serial number mixed with static strings, and the serial number can be retrieved by...
CVE-2020-25753: Undefined Security Weakness
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...
CVE-2020-25752: Use of Hard-coded Credentials
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. T...
MuPDF: Multiple vulnerabilities
Background MuPDF is a lightweight PDF viewer and toolkit written in portable C. Description Multiple vulnerabilities have been discovered in MuPDF. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted PDF document...
Security Bulletin: App Connect Enterprise Certified Container may be vulnerable to man in the middle attack through use of OpenSSL (CVE-2019-1551)
Summary App Connect Enterprise Certified Container may be vulnerable to man in the middle attack through use of OpenSSL via CVE-2019-1551 Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64...
Xen: Buffer overflow
Background Xen is a bare-metal hypervisor. Description An out-of-bounds read/write access issue was found in the USB emulator when using QEMU. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround There...
r3.org.uk Cross Site Scripting vulnerability OBB-1241218
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
fuseiso: Multiple vulnerabilities
Background FuseISO is a FUSE module to mount ISO filesystem images .iso, .nrg, .bin, .mdf and .img files. Description Multiple vulnerabilities have been discovered in fuseiso. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a...
PT-2020-1242 · Libyang · Libyang
Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0-r3 Description: A NULL pointer dereference issue is present in the lys extension instances free function due to a copy of unresolved extensions in lys restr dup. This can cause applications that use libyang to...
GLSA-201904-17 : Patch: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201904-17 Patch: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...
Patch: Multiple vulnerabilities
Background Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions. Description Multiple vulnerabilities have been discovered in Patch. Please review the CVE identifiers reference...
PT-2019-11215
Name of the Vulnerable Software and Affected Versions: SAP BASIS versions 7.0 through 7.02 SAP BASIS versions 7.10 through 7.30 SAP BASIS versions 7.31 SAP BASIS versions 7.40 SAP BASIS versions 7.50 through 7.53 Description: The issue concerns the ABAP BASIS function modules INST CREATE R3 RFC...