CVE-2025-30142: Authentication Bypass by Spoofing

An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for recognizing paired devices, allowing attackers to bypass authentication. By capturing the MAC address of an already-paired device through ARP...

CVE-2025-30140: Improper Access Control

An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name as an internal domain, creating a security risk. This domain was not owned by GNET originally, allowing an attacker to register it and...

CVE-2025-30141: Improper Access Control

An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream. It exposes API endpoints on ports 9091 and 9092 that allow remote access to recorded and live video feeds. An attacker who connects to the dashcam's network can retrieve all...

CVE-2025-30138: Improper Access Control

An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unauthorized persons. It allows unauthorized users to modify critical system settings once connected to its network. Attackers can extract...

CVE-2025-30139: Use of Default Credentials

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacke...

SUSE CVE-2022-49174

In the Linux kernel, the following vulnerability has been resolved: ext4: fix ext4mbmarkbb with flexbg with fastcommit In case of flexbg feature which is by default enabled, extents for any given inode might span across blocks from two different block group. ext4mbmarkbb only reads the bufferhead...

PT-2024-41608

Уязвимость функции xe bb create job модуля drivers/gpu/drm/xe/xe bb.c - драйвера поддержки инфраструктуры прямого рендеринга DRI ядра операционной системы Linux связана с копированием буфера без проверки входных данных. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживан...

SUSE CVE-2024-45023

In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix data corruption for degraded array with slow disk readbalance will avoid reading from slow disks as much as possible, however, if valid data only lands in slow disks, and a new normal disk is still in recovery,...

@bb-cli/bb-test-plugin-ngmock (1.5.8), @dbx/apx-lib (>=1.2.6, <=2.1.7) +80 more potentially affected by CVE-2024-8373 via angular-mocks (>=1.2.32, <=1.5.11)

angular-mocks NPM version =1.2.32, =1.2.6, =0.1.0, =1.0.4, =26.0.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2024-8373 Source advisory: MEND:CVE-2024-8373...

PT-2024-38075 · WordPress · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: The Bold Page Builder plugin for WordPress versions up to, and including, 5.0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's bt bb button shortcode due to insufficient input sanitization and output escapin...

Malicious code in bb-ui-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8398af17925a65881b1e463a1cbc606615814d86f9a5bab0db801d391bf6210a The OpenSSF Package Analysis project identified 'bb-ui-tools' @ 1.2.4 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7825 Malicious code in bb-ui-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8398af17925a65881b1e463a1cbc606615814d86f9a5bab0db801d391bf6210a The OpenSSF Package Analysis project identified 'bb-ui-tools' @ 1.2.4 npm as malicious. It is considered malicious because: - The package...

XenForo 2.2.15 Cross Site Request Forgery Vulnerability

------------------------------------------------------------------------------- XenForo = 2.2.15 Widget::actionSave Cross-Site Request Forgery Vulnerability ------------------------------------------------------------------------------- - Software Link: https://xenforo.com - Affected Versions:...

PT-2024-28948

Name of the Vulnerable Software and Affected Versions TorrentPier versions prior to 2.4.4 Description The issue arises from the use of the unsafe native PHP serialization format to deserialize user-controlled cookies in the get tracks function, located in torrentpier/library/includes/functions.ph...

UBUNTU-CVE-2024-26774

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mbupdateavgfragmentsize when block bitmap corrupt Determine if bbfragments is 0 instead of determining bbfree to eliminate the risk of dividing by zero when the block bitmap is corrupted...

@bb-cli/bb-test-plugin-ngmock (1.5.8), @dbx/apx-lib (>=1.2.6, <=2.1.7) +80 more potentially affected by CVE-2024-21490 via angular-mocks (>=1.2.32, <=1.5.11)

angular-mocks NPM version =1.2.32, =1.2.6, =0.1.0, =1.0.4, =26.0.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.1.0, =0.1.0, =0.1.0, =3.14.2 and more Source cves: CVE-2024-21490 Source advisory: MEND:CVE-2024-21490...

forum-bb-rw.ch Cross Site Scripting vulnerability OBB-3831755

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Plugin Inline Image Upload for BBPress Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

bb-dev.com Cross Site Scripting vulnerability OBB-3819685

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bb-whv.de Improper Access Control vulnerability OBB-3768132

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...