CVE-2025-28169

BYD QIN PLUS DM-i Dilink OS v3.013.1.7.2204050.1 to v3.013.1.7.2312290.10 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack...

CVE-2025-28169: Improper Certificate Validation

BYD QIN PLUS DM-i Dilink OS v3.013.1.7.2204050.1 to v3.013.1.7.2312290.10 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack...

Mockoon has a Path Traversal and LFI in the static file serving endpoint

Summary A mock API configuration for static file serving following the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server...

Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs

SUMMARY A recent report from the German news outlet Spiegel has revealed a significant security breach impacting hundreds…...

CVE-2024-47577 Information Disclosure vulnerability in SAP Commerce Cloud

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating ...

CVE-2024-48107

SparkShop =1.1.7 is vulnerable to server-side request forgery SSRF. This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server...

CVE-2024-48107

SparkShop =1.1.7 is vulnerable to server-side request forgery SSRF. This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server...

CVE-2024-48107

Versions of SparkShop up to and including 1.1.7 are vulnerable to server-side request forgery (SSRF) . This flaw allows an attacker to scan ports on the intranet or local network where the server is hosted, target internal applications, or access cloud server metadata. No specific remediation or ...

CVE-2024-48107

SparkShop =1.1.7 is vulnerable to server-side request forgery SSRF. This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server...

Multiple Safie products vulnerable to improper server certificate verification

Overview Multiple Safie products are vulnerable to improper server certificate verification CWE-295. The product can be operated via port 11029/TCP and Bluetooth, and its communications are AES encrypted. The product user can obtain the encryption key from the cloud server based on the...

JVN#83440451: Multiple Safie products vulnerable to improper server certificate verification

Multiple Safie products are vulnerable to improper server certificate verification CWE-295. The product can be operated via port 11029/TCP and Bluetooth, and its communications are AES encrypted. The product user can obtain the encryption key from the cloud server based on the device-specific...

Data Leak Exposes 1.5 Billion Real Estate Records, Including Elon Musk, Kylie Jenner

By Waqas A Campbell, New York-based real estate training platform called Real Estate Wealth Network exposed a massive treasure trove of real estate records due to cloud server misconfiguration. This is a post from HackRead.com Read the original post: Data Leak Exposes 1.5 Billion Real Estate...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

WEM: after upgrade , Agent does not register with the cloud infrastructure server

After running the configuration utility on the agent to migrate to the cloud WEM broker server it looses the connectivity. Checking theCitrix WEM Agent Host service debug logs show the below error Event - BaseBrokerClient1.GetConnectorAuthContext : Successfully acquired connector authentication...

WordPress WP Cloud Server Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Cloud Server Type Plugin Vulnerable versions = 1.3.0 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 8cdd8c408320 Credits Rafie Muhammad Patchstack Required...

francecloudserver.com Cross Site Scripting vulnerability OBB-3365372

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-21700 · Snap One · Snap One Ovrc

Name of the Vulnerable Software and Affected Versions: Snap One OvrC affected versions not specified Description: The issue allows an attacker to enumerate device MAC addresses and obtain information about the devices from the Snap One OvrC cloud servers. When a random MAC address is provided, th...

Jenkins Azure VM Agents Plugin missing permission checks

Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another...

CVE-2023-32990

A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method...

CVE-2023-32990

A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method...