27 matches found
CVE-2026-82448
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...
EUVD-2026-68097
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...
CVE-2026-82448
Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...
CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...
CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...
PT-2026-83427
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...
CVE-2021-27228
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
EUVD-2021-13993
Malware in sbrugna...
rcm.shinobi.jp Open Redirect vulnerability OBB-2732250
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-27228
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
CVE-2021-27228
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
Design/Logic Flaw
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
CVE-2021-27228
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
CVE-2021-27228
CVE-2021-27228 affects Shinobi (Ocean version 1) where lib/auth.js implements Incorrect Access Control. An internal JavaScript object stores API keys; an attacker can exploit JS prototype method names (e.g., constructor, hasOwnProperty) to make the system treat a supplied API key as valid, result...
CVE-2021-27228
An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...
Moe Shinobi through ocean Trust Management Issues Vulnerability
Moe Shinobi through ocean is an application for the Moe community in Canada. It provides i video management functionality. Shinobi through ocean version 1 suffers from a trust management issue vulnerability, which can be exploited by an attacker to achieve full access to the user management API...
@mdslab/iotronic-lightning-rod (>=2.3.1, <=2.3.6), connection-test-table (>=0.1.0, <=0.1.3) +9 more potentially affected by CVE-2020-7781 via connection-tester (>=0.0.7, <=0.2.0)
connection-tester NPM version =0.0.7, =2.3.1, =0.1.0, =0.0.1, =0.0.1, =0.0.10, =1.1.3, =0.0.1, =0.0.1, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2020-7781 Source advisory: OSV:GHSA-W5MP-8P8W-MHH8...
rcm.shinobi.jp Open Redirect vulnerability
Open Bug Bounty ID: OBB-1146020 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting rcm.shinobi.jp website and its users. Following...
Shinobi Security Software 1.0 Database Disclosure
Exploit Title : Shinobi Security Software 1.0 Database Disclosure Exploit Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 02/04/2019 Vendor Homepage : shinobi.video Software Download Link : github.com/moeiscool/Shinobi/archive/master.zip Software Information Lin...
Shinobi War - Base64 encoded String, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Shinobi War published at the 'play' market has multiple vulnerabilities...