134 matches found
Shop Beat Media Player 访问控制错误漏洞
Shop Beat is a media player from Shop Beat, Inc. A security vulnerability exists in Shop Beat Media Player versions 2.5.95 through 3.2.57, which originates from a login that can bypass secondary authentication by accessing the API directly with a bearer token or jsession ID...
CVE-2022-36247: Authorization Bypass Through User-Controlled Key
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za...
CVE-2022-36246: Undefined Security Weakness
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...
CVE-2022-36243: Exposure of Information Through Directory Listing
Shop Beat Solutions pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2....
CVE-2022-36247
Shop Beat Media Player versions 2.5.95–3.2.57 are vulnerable to an Insecure Direct Object Reference (IDOR) via controlpanel.shopbeat.co.za. The root cause is IDOR, leading to unauthorized access to resources; CVSS 3.1 indicates high confidentiality and integrity impact (score 9.1). No patch/versi...
CVE-2022-36250: Cross-Site Request Forgery (CSRF)
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...
CVE-2022-36247 Shop Beat Services Vulnerable To IDOR
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za...
CVE-2022-36249: Authentication Bypass Using an Alternate Path or Channel
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...
CVE-2022-36244: Improper Neutralization of Input During Web Page Generation
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...
CVE-2022-36244
Shop Beat Media Player (versions 2.5.95–3.2.57) is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Shop Beat Control Panel (URLs: www.shopbeat.co.za, controlpanel.shopbeat.co.za). The root cause is stored XSS in the control panel exposed to user input; impact include...
CVE-2022-36247
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za...
CVE-2022-36249
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...
CVE-2022-36244
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...
CVE-2022-36246
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...
CVE-2022-36250
Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...
CVE-2022-36243
Shop Beat Solutions pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2....
beat-plug.com Cross Site Scripting vulnerability OBB-2938554
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
getLastPrice() return wrong price
Lines of code Vulnerability details Impact operate and addObservation both of them use PRICE.getLastPrice but it will return wrong price. So all the updates are just random prices Proof of Concept 1- keeper invoke beat on Heart.sol 2- this operator.operate; to trigger price range update and marke...
openbeat.net Cross Site Scripting vulnerability OBB-2379912
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
euro-beat.be Cross Site Scripting vulnerability OBB-1262382
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...