ssl.samidare.jp Cross Site Scripting vulnerability OBB-3540061

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

uni-lj.si Cross Site Scripting vulnerability OBB-3539430

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-3828

A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0. It has been classified as problematic. This affects an unknown part of the file /listplace/user/coverPhotoUpdate of the component Photo Handler. The manipulation of the argument usercoverphoto leads to cross site...

CVE-2023-37915

OpenDDS (C++ implementation of OMG DDS) is affected by CVE-2023-37915 due to a vulnerability in parsing a malformed PID_PROPERTY_LIST within a DATA submessage during participant discovery. The underlying issue can cause remote crashes of OpenDDS processes when a crafted DATA submessage is sent to...

CVE-2023-37915 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. OpenDDS crashes while parsing a malformed PIDPROPERTYLIST in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage...

CVE-2023-37915 Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDS

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. OpenDDS crashes while parsing a malformed PIDPROPERTYLIST in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage...

pfSense v2.7.0 - OS Command Injection Exploit

Exploit Title: pfSense v2.7.0 - OS Command Injection Exploit Author: Emir Polat CVE-ID : CVE-2023-27253 class MetasploitModule 'pfSense Restore RRD Data Command Injection', 'Description' = %q This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of...

PT-2023-26182 · Opendds · Opendds

Name of the Vulnerable Software and Affected Versions: OpenDDS versions prior to 3.25 Description: OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. It crashes while parsing a malformed PID PROPERTY LIST in a DATA submessage during...

The vulnerability of the Avahi service detection system in local networks, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Avahi service detection system in local networks is related to an uncontrolled consumption of resources. Exploiting this vulnerability allows a perpetrator to cause service failures...

CVE-2023-38427

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemblenegcontexts...

south.cavedirect.com Cross Site Scripting vulnerability OBB-3525174

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-36849

An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon l2cpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a Denial of Service DoS. When a malformed LLDP packet is received, l2cpd will...

Brute Force Token Secrets

superfly/tokenizer is vulnerable to brute-force of token secrets vulnerability. The vulnerability is due to not restricting formatting in fmt parameter to simple formatting and allowing fmt/dst parameters to be specified at request time leading to attacker brute forcing secret values using...

CVE-2023-30226

An issue was discovered in function getgnuverneed in rizinorg Rizin prior to 0.5.0 verneedentry allows attackers to cause a denial of service via crafted elf file...

sirwinston.fr Cross Site Scripting vulnerability OBB-3505158

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures

A Microsoft Windows policy loophole has been observed being exploited primarily by native Chinese-speaking threat actors to forge signatures on kernel-mode drivers. "Actors are leveraging multiple open-source tools that alter the signing date of kernel mode drivers to load malicious and unverifie...

Exploit for Race Condition in Qualcomm Apq8053_Firmware

Fork My adaptation for the SM-F926U from the original exploit...

CVE-2023-30956

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0...

CVE-2023-35698

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt...

The vulnerability of the system() function in NETGEAR RAX30 microprogramming devices allows a hacker to execute arbitrary code.

The vulnerability of the system function in NETGEAR RAX30 microprogramming devices stems from insufficient validation of input data during the processing of port discovery requests via UPnP. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...