Kamailio 5.4.0 Header Smuggling

Kamailio vulnerable to header smuggling possible due to bypass of removehf - Fixed versions: Kamailio v5.4.0 - Enable Security Advisory: - Tested vulnerable versions: 5.3.5 and earlier - Timeline: - Report date & issue patched by Kamailio: 2020-07-16 - Kamailio rewrite for header parser better fi...

Business Alliance Financial Circle Security Breach

Business Alliance Financial Circle BAFC is a cryptocurrency. A security vulnerability exists in the 'UBSexToken' function in BAFC's smart contract implementation, which stems from the fact that the function is publicly available and does not check the identity of the caller. An attacker could use...

Cryptbond Network Authorization Issues Vulnerability

Cryptbond Network CBN is a cryptocurrency. A security vulnerability exists in the 'ToOwner' function in CBN's smart contract implementation, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to modify the owner of the...

FreeBSD : Python -- multiple vulnerabilities (33c05d57-bf6e-11ea-ba1e-0800273f78d3)

Python reports : The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwage...

CVE-2020-13696

An issue was discovered in LinuxTV xawtv before 3.107. The function devopen in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to...

DDQ Authorization Issues Vulnerability

DDQ is a cryptocurrency.A security vulnerability exists in the 'owned' function of DDQ's smart contract implementation, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to modify the owner of a smart contract...

Business Alliance Financial Circle has a logic flaw vulnerability

Business Alliance Financial Circle BAFC is a cryptocurrency.A security vulnerability exists in the 'UBSexToken' function in BAFC's smart contract implementation, which stems from the fact that the function is publicly available and does not check the identity of the caller. The vulnerability can ...

BOMBBA Authorization Issue Vulnerability

BOMBBA BOMB is a cryptocurrency.A security vulnerability exists in the 'quaker' function of BOMB's smart contract implementation, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to modify the owner of the smart contrac...

NewIntelTechMedia License Issues Vulnerabilities

NewIntelTechMedia NETM is a cryptocurrency.A security vulnerability exists in the 'NETM' function in NETM's smart contract implementation, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to modify the owner of the smar...

CVE-2020-12680

Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and th...

Would You Have Fallen for This Phone Scam?

You may have heard that today's phone fraudsters like to use caller ID spoofing services to make their scam calls seem more believable. But you probably didn't know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on you...

GHSA-PCQQ-5962-HVCW Denial of Service in uap-core when processing crafted User-Agent strings

Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-ruby to = v2.6....

ASTPP VoIP 4.0.1 - Remote Code Execution Vulnerability

Exploit Title: ASTPP VoIP 4.0.1 - Remote Code Execution Exploit Author: Fabien AUNAY Vendor Homepage: https://www.astppbilling.org/ Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1 Version: 4.0.1 vendor default setup script Tested on: Debian 9 - CentOS 7 CVE : - ASTPP 4.0.1 VoIP Billi...

DDQ override vulnerability

DDQ is a cryptocurrency. A security vulnerability in the 'owned' function in DDQ's smart contract implementation stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of a smart contract...

Cryptbond Network Override Vulnerability

Cryptbond Network CBN is a cryptocurrency. An override vulnerability exists in the 'ToOwner' function in the smart contract implementation of Cryptbond Network CBN, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...

BOMBBA Override Vulnerability

BOMBBA BOMB is a cryptocurrency. BOMBBA BOMB has an override vulnerability in the 'quaker' function in its smart contract implementation, which stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of the smart contract...

CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

FusionPBX Operator Panel (exec.php) Command Execution Exploit

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operatorpanelview permissions, or administrator permissions, to execute arbitrary commands as the web server user ...

CVE-2019-17191

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block...

Design/Logic Flaw

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block...