irfan.fr Cross Site Scripting vulnerability OBB-2333127

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mozilla: Use-after-free of ChannelEventQueue::mOwner

The Mozilla Foundation Security Advisory describes this flaw as: Certain network request objects were freed too early when releasing a network request handle. This could have led to a use-after-free issue, causing a potentially exploitable crash...

CVE-2021-46059

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Design/Logic Flaw

Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages...

Organized Cybercrime Cases: What CISOs Need to Know

Jon Clay, VP of Threat Intelligence at Trend Micro, explores the latest Trend Micro Research covering Access as a Service AaaS, an emerging business model selling all-access passes to other malicious actors...

WordPress 5.8 < 5.8.3 / 5.7 < 5.7.5 / 5.6 < 5.6.7 / 5.5 < 5.5.8 / 5.4 < 5.4.9 / 5.3 < 5.3.11 / 5.2 < 5.2.14 / 5.1 < 5.1.12 / 5.0 < 5.0.15 / 4.9 < 4.9.19 / 4.8 < 4.8.18 / 4.7 < 4.7.22 / 4.6 < 4.6.22 / 4.5 < 4.5.25 / 4.4 < 4.4.26 / 4.3 < 4.3.27 / 4.2 < 4.2.31 / 4.1 < 4.1.34 / 4.0 < 4.0.34 / 3.9 < 3.9.35 / 3.8 < 3.8.37 / 3.7 < 3.7.37

WordPress versions 5.8 5.8.3 / 5.7 5.7.5 / 5.6 5.6.7 / 5.5 5.5.8 / 5.4 5.4.9 / 5.3 5.3.11 / 5.2 5.2.14 / 5.1 5.1.12 / 5.0 5.0.15 / 4.9 4.9.19 / 4.8 4.8.18 / 4.7 4.7.22 / 4.6 4.6.22 / 4.5 4.5.25 / 4.4 4.4.26 / 4.3 4.3.27 / 4.2 4.2.31 / 4.1 4.1.34 / 4.0 4.0.34 / 3.9 3.9.35 / 3.8 3.8.37 / 3.7 3.7.37...

rent-a-fun.de Cross Site Scripting vulnerability OBB-2323403

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ASB-A-202025599

Bulletin has no description...

ASB-A-193070557

Bulletin has no description...

ASB-A-202025735

Bulletin has no description...

What the Rise in Cyber-Recon Means for Your Security Strategy

As we move into 2022, bad actors are ramping up their reconnaissance efforts to ensure more successful and more impactful cyberattacks. And that means more zero-day exploits are on the horizon. When seen through an attack chain such as the MITRE ATT&CK framework, campaigns are frequently discusse...

trade-a-plane.com Cross Site Scripting vulnerability OBB-2309474

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-35244

CVE-2021-35244 affects SolarWinds Orion Platform: the Log alert to a file action in Orion alert management allows an authenticated user with alert-management rights to write to arbitrary files, enabling an unrestricted file upload and remote code execution. Public disclosures (ZDI-22-375) describ...

‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems

Researchers have tracked new spyware – dubbed “PseudoManuscrypt” because it’s similar to “Manuscrypt” malware from the Lazarus advanced persistent threat APT group – that’s attempted to scribble itself across more than 35,000 targeted computers in 195 countries. Kaspersky researchers said in a...

Siemens Healthineers syngo fastView (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Healthineers, a subsidiary of Siemens Equipment: syngo fastView --------- Begin Update A Part 1 of 2 -------- Vulnerabilities: Out-of-bounds Write, Write-what-where Condition --------- End Update A Part 1 of 2...

CVE-2021-39644

Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A...

CVE-2021-1040

In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2021-1045

Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/A...

CVE-2021-1034

In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without querypermissions due to a missing permission check. This could lead to localinformation disclosure with no additional execution privileges needed. Userinteraction is...

CVE-2021-1020

In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...