CVE-2023-27587: Generation of Error Message Containing Sensitive Information

ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google...

CVE-2023-27587

ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google...

CVE-2023-27587

ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google...

Cross site scripting

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

CVE-2022-4929 icplayer tts-utils.js cross site scripting

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

CVE-2022-4929

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

PT-2023-15916 · Icplayer · Icplayer

Name of the Vulnerable Software and Affected Versions: icplayer versions up to 0.818 Description: A vulnerability was found in icplayer, affecting some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched...

CVE-2022-4929: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

icplayer cross-site scripting vulnerability

icplayer is icplayer open source HTML5 player for an interactive course. A cross-site scripting vulnerability exists in versions prior to icplayer 0.819, which stems from a problem with the file addons/Commons/src/tts-utils.js, which can lead to cross-site scripting...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to improper input validation in Spring Framework (CVE-2022-22950)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service, caused by improper input validation in VMware Tanzu Spring Framework CVE-2022-22950. Spring Framework is used in Watson Speech Services to build our STT and TTS java services Please read...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2022-22821 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2022-22821 Source advisory: OSV:GHSA-RPX7-33J2-XX9X...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by unknown CVE via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory: GHSA-RPX7-33J2-XX9X...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2022-22821 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2022-22821 Source advisory: OSV:GHSA-9HG3-HMMF-C3GR...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2022-22821 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2022-22821 Source advisory: GHSA-9HG3-HMMF-C3GR...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2), variantworks (>=0.1.0.dev201117, <=0.1.0.dev210511) potentially affected by CVE-2022-22821 via nemo-toolkit (>=0.10.1, <=1.5.1)

nemo-toolkit PYPI version =0.10.1, =0.0.1, =0.1.0.dev201117, =0.1.0.dev210511 Source cves: CVE-2022-22821 Source advisory: MEND:CVE-2022-22821...

Google Assistant Authentication Bypass Vulnerability

Google Assistant suffered from an authentication bypass vulnerability allowing a webpage to execute commands without permission. Auth Bypass in Google Assistant Summary: Webpage can execute Google Assistant commands without any permissions Steps to reproduce: Generate the TTS audio files using th...

alumni.tts.edu.sg Cross Site Scripting vulnerability OBB-1360496

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Hackers Can Use Ultrasonic Waves to Secretly Control Voice Assistant Devices

Researchers have discovered a new means to target voice-controlled devices by propagating ultrasonic waves through solid materials in order to interact with and compromise them using inaudible voice commands without the victims' knowledge. Called "SurfingAttack," the attack leverages the unique...

GSA Bounty: Cache poisoning DoS to various TTS assets

I have recently come across a technique to force a Cloudfoundry app to return a HTTP 404 error when requesting any resource, which contains cache friendly headers. What this means is, if the Cloudfoundry app in question is behind a web cache like Cloudfront or Cloudflare etc, it will possibly sto...