5542 matches found
Design/Logic Flaw
Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...
CVE-2018-17981
Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...
CVE-2018-17981
CVE-2018-17981 affects Lifesize Express devices running ls ex2_4.7.10 (2000 (14) devices). The vulnerability is a cross-site scripting (XSS) flaw exploitable via the interface/interface.php brand parameter, leading to potential script execution in a user’s browser. Root cause is an XSS in the bra...
CVE-2018-16847
An out-of-bounds heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvmecmbops routines in a nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in denial of service or, potentially, run arbitrary code wi...
Authentication Bypass
Overview All versions of express-laravel-passport are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users. Recommendation Upgrade to version 2.0.5 or later. References - HackerOne Report - GitHub...
express-elect.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1063379 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
MongoDB mongo-express Remote Code Execution (CVE-2019-10758)
A remote code execution vulnerability exists in MongoDB mongo-express. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
GHSA-H47J-HC6X-H3QQ Remote Code Execution Vulnerability in NPM mongo-express
Impact Remote code execution on the host machine by any authenticated user. Proof Of Concept Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator: javascript this.constructor.constructor"return...
Remote Code Execution Vulnerability in NPM mongo-express
Impact Remote code execution on the host machine by any authenticated user. Proof Of Concept Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator: javascript this.constructor.constructor"return...
MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure
Exploit: MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Date: 2019-12-30 Author: LiquidWorm Vendor: Emmanuel Product web page: https://github.com/empierre/MyDomoAtHome https://www.domoticz.com/wiki/ImperiHome https://docs.imperihome.com/app/iss Affected version: 0.2.40...
MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Vulnerability
Exploit for hardware platform in category web applications Exploit: MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure Author: LiquidWorm Vendor: Emmanuel Product web page: https://github.com/empierre/MyDomoAtHome https://www.domoticz.com/wiki/ImperiHome...
Exploit for Code Injection in Mongo-Express_Project Mongo-Express
CVE-2019-10758 PoC Setup docker run -p 27017:27017 -...
The vulnerability of the Cisco Unity Express aut secretary, related to the refusal to accept measures for eliminating special elements used in the operating system’s command, allows a hacker to elevate their privileges and execute arbitrary code.
The vulnerability of the Cisco Unity Express autochanger lies in its inability to accept measures to neutralize special elements. Exploiting this vulnerability may allow an attacker to enhance their privileges and execute arbitrary code...
mongo-express code execution vulnerability
mongo-express is a lightweight web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express versions prior to 0.54.0. An attacker can exploit this vulnerability to execute code with the help of an endpoint using the toBSON method...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
Vulnerability of the iwl_pcie_ctxt_info_gen3_init() function (drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c) in the Linux kernel, allowing a hacker to cause a service failure
The vulnerability of the iwlpciectxtinfogen3init function located in the drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c file in the Linux kernel leads to uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...