bm-lyon.fr XSS vulnerability

Open Bug Bounty ID: OBB-635474 Description| Value ---|--- Affected Website:| bm-lyon.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Virtuozzo 6 : parallels-server-bm-release / etc (VZA-2018-017)

According to the versions of the parallels-server-bm-release / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel through 4.14.13, the rdsmessageallocsgs function does not validate a value that is used during...

bm-bagneux92.fr XSS vulnerability

Open Bug Bounty ID: OBB-586225 Description| Value ---|--- Affected Website:| bm-bagneux92.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-002)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-114)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - dccpdisconnect set the socket state to DCCPCLOSED but did not properly free some of the resources...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-107)

According to the version of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user t...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-090)

According to the version of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built...

bm-rappi.ch XSS vulnerability

Open Bug Bounty ID: OBB-317177 Description| Value ---|--- Affected Website:| bm-rappi.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-085)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Kernel crash due to missing error handling for negatively instantiated keys. - A stack buffer overflow...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735

Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2017-12735. All versions before v8.3 are vulnerable to a Man-in-the-Middle attack that could allow an attacker to decrypt and modify traffic between the LOGO! BM and other devices. The issue is mitigated by updating to firmware v8.3 (n...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

Siemens LOGO! 8 BM (incl. SIPLUS variants): all versions prior to V1.81.2 are affected by CVE-2017-12734 (Insufficiently Protected Credentials). An attacker with network access to the integrated web server on port 80/tcp can obtain the session ID of an active user session, requiring a logged-in u...

Siemens LOGO! (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Vulnerabilities: Insufficiently Protected Credentials, Man-in-the-Middle 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...