Cross-Site Request Forgery (CSRF)

esphome is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to inadequate validation of incoming requests within webserver.py, allowing an attacker to perform unauthorized actions on configuration files such as creating, editing, or deleting files...

Heap-based Buffer Overflow

libgpac.so is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper input size validation within the ffwrite component function in utils/osfile.c, which allows remote attackers to execute arbitrary code or cause a Denial of Service DoS through crafted input...

Medialist < 1.4.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

garibaldi.pisa.it Cross Site Scripting vulnerability OBB-3756002

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation

Description The plugin does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation. PoC curl 'https://example.com/' -d...

myapp.tcs.com Cross Site Scripting vulnerability OBB-3494054

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Log Injection

github.com/gin-gonic/gin is vulnerable to log injection. The vulnerability exists in logger.go due to the lack of validation in library logs, which allows an attacker to inject malicious code into the system...

Exploit for Path Traversal in Apache Http_Server

PoC exploit for CVE-2021-41773, an Apache HTTP Server 2.4.49 and...

Privilege Escalation

git is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation of user inputs which allows an attacker to access the git repository perform unauthorized actions...

valeriehusemann.de Cross Site Scripting vulnerability OBB-2717264

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists in the netItemStackToCore function in TypeConverter.php due to a lack of validation in item ids which allows an attacker to cause an application crash...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. Lack of proper validation of input arguments to tf.rawops.QuantizeAndDequantizeV4Grad leads to CHECK-failure, causing an applicaiton crash...

Remote Code Execution (RCE)

spip is vulnerable to remote code execution. The vulnerability exists due to a lack of validation allowing an attacker to execute maliciously crafted script in the system...

Exploit for Path Traversal in Apache Http_Server

cve-2021-41773 and cve-2021-42013 Batch verification of Pyth...

Cross-site Scripting (XSS)

zoneminder is vulnerable to Cross Site Scripting. The vulnerability exists due to a lack of validation of the 'Exportfile' parameter value in the view export export.php...

Adobe FrameMaker PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe FrameMaker. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

SourceCodester E-Commerce Website SQL Injection Vulnerability

SourceCodester E-Commerce Website is a software application. A PHP e-commerce website project for bookstores. A SQL injection vulnerability exists in SourceCodester E-Commerce Website version V1.0, which originates from a lack of validation of the update parameter of empViewUpdate.php against an...

GHSA-QGP4-5QX6-548G Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby

Impact An editor with write access to the Kirby Panel can upload an SVG or XML file that contains harmful content like tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script wi...

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB4535103)

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB4535103 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2...

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB4534977)

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB4534977 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2...