102 matches found
Exploit for Deserialization of Untrusted Data in Apache Kafka_Connect
Apache Druid CVE-2023-25194 CVE-2023-25194 is a deserializati...
CVE-2024-26897
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9kwmieventtasklet until init is complete The ath9kwmieventtasklet used in ath9khtc assumes that all the data structures have been fully initialised by the time it runs. However, because of the order i...
CVE-2021-46983 nvmet-rdma: Fix NULL deref when SEND is completed with error
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: Fix NULL deref when SEND is completed with error When running some traffic and taking down the link on peer, a retry counter exceeded error is received. This leads to nvmetrdmaerrorcomp which tried accessing the...
Mars: CVE-█████-35813 in █████
A critical remote code execution vulnerability CVE-█████-35813 affecting multiple Sitecore products through version 10.3 was discovered. The vulnerability was exploited through the sitecorexaml.ashx endpoint using ASP.NET TemplateParser injection, allowing attackers to execute arbitrary code. The...
Reactivated gauges have incorrect accounting for the last cycle’s rewards
Lines of code Vulnerability details Impact reactivated gauges that previously had queued up rewards have a mismatch between their storedCycle and contract’s gaugeCycle state variable. Due to this mismatch, there is also a resulting issue with the accounting logic for its completed rewards: Proof ...
gelaramdentalclinic.com Cross Site Scripting vulnerability OBB-3271434
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PaperCut NG SetupCompleted Improper Access Control Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can...
CVE-2023-25724
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
paint-inspector.com Cross Site Scripting vulnerability OBB-3172701
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
SAMSUNG Mobile devices 安全漏洞
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices SMR Nov-2022 Release 1, which originates from an improper access control vulnerability in...
CVE-2021-41576
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none...
m.cd9l2f.cyou Cross Site Scripting vulnerability OBB-2860401
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
It should never be possible to change the status of a completed task
Lines of code Vulnerability details High Risk Finding Impact In Project.sol, once a task is set as completed by calling function setComplete, the contract pays the subcontractor. Once in this state, in should not be possible to change the task state back to ACTIVE/INACTIVE, because then the same...
CVE-2022-27149
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Exploit for Code Injection in Vmware Spring_Framework
CVE-2022-22965 Spring4Shell Proof of Concept !img/spring...
Last 24 hours -> Running view lists sessions that are actually in stopped state
Challenge Under certain circumstances, the Last 24 hours Running view displays "extra" sessions that are actually in a stopped state. An example where 3 tasks are running, but the "Running" view displays completed stopped tasks. Cause To improve UI responsiveness, some UI data is cached. The issu...
Completed proposals can be voted on and executed again
Handle @cmichelio Vulnerability details Vulnerability Details A proposal that is completed has its state reset, including the votes. Users can just vote on it again and it can be executed again. Impact Completed proposals should most likely not be allowed to be voted on / executed again. This cou...
Xen Handling Logic Error Vulnerability
Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A processing logic error vulnerability...
universal-prints.de Cross Site Scripting vulnerability OBB-1342497
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-0055
In l2clinkprocessnumcompletedpkts of l2clink.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...