zzl.ddc1888.de Cross Site Scripting vulnerability OBB-2120384

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials Vulnerability

======================================================================= title: Multiple Critical Vulnerabilities product: Multiple Altus Sistemas de Automacao products: Nexto NX30xx Series Nexto NX5xxx Series Nexto Xpress XP3xx Series Hadron Xtorm HX3040 Series vulnerable version: See "Vulnerable...

Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: Multiple Altus Sistemas de Automacao products: Nexto NX30xx Series Nexto NX5xxx Series Nexto Xpress XP3xx Series Hadron Xtorm...

CVE-2019-14453

An issue was discovered in Comelit "App lejos de casa web" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges installer or administrator for the graphical interface via a...

CVE-2019-14453

CVE-2019-14453 affects Comelit App lejos de casa (web) 2.8.0. A privilege-escalation flaw is triggered by modifications to domus and logged fields, related to js/bridge.min.js and login.json, enabling attackers to achieve installer/administrator level within the graphical interface (e.g., via a 1...

PT-2021-8976

Name of the Vulnerable Software and Affected Versions Comelit "App lejos de casa web" version 2.8.0 Description The issue allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. An attacker can achieve high privileges, such as installer or...

CVE-2019-14453: Improper Privilege Management

An issue was discovered in Comelit "App lejos de casa web" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges installer or administrator for the graphical interface via a...

Comelit App lejos de casa 安全漏洞

Comelit App lejos de casa is a home automation application from the Spanish company Comelit. A security vulnerability in Comelit App lejos de casa 2.8.0 allows attackers to elevate privileges via modified domain and log fields associated with js/bridge.min.js and login.json...

De-anonymization Story

This is important: Monsignor Jeffrey Burrill was general secretary of the US Conference of Catholic Bishops USCCB, effectively the highest-ranking priest in the US who is not a bishop, before records of Grindr usage obtained from data brokers was correlated with his apartment, place of work,...

CVE-2021-32750

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

CVE-2021-32750

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

Design/Logic Flaw

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

CVE-2021-32750

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

CVE-2021-32750 De-anonymization via message

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

CVE-2021-32750

MuWire desktop client

CVE-2021-32750: Exposure of Sensitive Information to an Unauthorized Actor

MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL...

PT-2021-19904

Name of the Vulnerable Software and Affected Versions MuWire versions prior to 0.8.8 Description The issue allows an attacker to de-anonymize users of the MuWire desktop client by sending a message with a subject line containing a URL with an HTML image tag. When the MuWire client attempts to fet...

OSV-2021-991 Dynamic-stack-buffer-overflow in fmt::v8::detail::dragonbox::umul192_upper64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36110 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: fmt::v8::detail::dragonbox::umul192upper64 fmt::v8::detail::dragonbox::cacheaccessor::computemul fmt::v8::detail::dragonbox::decimalfp...

Important: mod_http2

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: modhttp2 Note: This advisory is applicabl...

Important: httpd

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: httpd Note: This advisory is applicable t...