CVE-2022-26975

CVE-2022-26975 affects the Barco Control Room Management Suite web application (part of TransForm N) prior to version 3.14. The issue is exposure of log files without authentication, as documented by Red Hat/NVD entries and vendor references. CVSSv3.1 base score 7.5 (HIGH) with HIGH confidentiali...

CVE-2022-26975

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication...

CVE-2022-26974

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS...

CVE-2022-26974

The CVE affects Barco Control Room Management Suite web application (TransForm N before 3.14). A lack of input sanitization in the file-upload mechanism allows reflected XSS in the affected component. Red Hat and CNVD entries corroborate the vulnerability before version 3.14. Remediation is to up...

CVE-2022-26973

The Barco Control Room Management Suite web application (TransForm N) prior to version 3.14 exposes a license file upload mechanism. The root cause is a flaw in handling the license file name, where manipulating the filename causes the application to return an error message that reveals internal ...

CVE-2022-26973

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details...

CVE-2022-26972

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS...

CVE-2022-26972

Barco Control Room Management Suite (TransForm N) web application is affected up to version 3.14. The vulnerability stems from unsanitized URL parameters on the /cgi-bin endpoint, enabling reflected cross-site scripting (XSS). Multiple connected sources corroborate the issue and scope, without de...

CVE-2022-26971

Barco Control Room Management Suite web application (TransForm N, before version 3.14) exposes a license file upload mechanism that can be triggered without authentication. Root cause: unauthenticated upload path accessible in the web interface. Impact: enables unauthorized file uploads (license ...

CVE-2022-26971

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication...

Lumos System Can Find Hidden Cameras and IoT Devices in Your Airbnb or Hotel Room

A group of academics has devised a system that can be used on a phone or a laptop to identify and locate Wi-Fi-connected hidden IoT devices in unfamiliar physical spaces. With hidden cameras being increasingly used to snoop on individuals in hotel rooms and Airbnbs, the goal is to be able to...

GHSA-JJMC-4P83-PP26 Logic error in Matrix SDK for Android

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 leads to a situation where identity verification is inadequate and thus a key-requesting device can be impersonated...

Logic error in Matrix SDK for Android

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 leads to a situation where identity verification is inadequate and thus a key-requesting device can be impersonated...

GHSA-W47G-4VRC-M3W2 Cross-site Scripting in Apache Pluto Chatroom demo

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...

CVE-2022-30839

Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting XSS via /rrps/classes/Master.php?f=savecategory, vehiclename...

CVE-2022-30839

Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting XSS via /rrps/classes/Master.php?f=savecategory, vehiclename...

CVE-2022-30843

Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...

CVE-2022-30839

Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting XSS via /rrps/classes/Master.php?f=savecategory, vehiclename...

CVE-2022-30843

Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...

CVE-2022-30843

Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...