UBUNTU-CVE-2022-41678

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

flight-club-manager.de Improper Access Control vulnerability OBB-3774824

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-QPPJ-FM5R-HXR3 HTTP/2 Stream Cancellation Attack

HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...

scenery.flightgear.org Cross Site Scripting vulnerability OBB-3594761

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vulnerability disclosure in aviation

We joined Boeing and United Airlines on a panel recently at the RSA Conference to talk about vulnerability disclosure in the aviation world. The engagement we are now seeing between researchers and industry is a powerful force for positive change. Hopefully this will start to reduce the number of...

WordPress Flight Search Widget and Blocks Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Flight Search Widget and Blocks Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 492a34dd0ab4 Credits Rafie Muhammad...

EFB vulnerability in Lufthansa’s Lido eRouteManual

Almost all commercial airlines now use electronic flight bags EFBs to drive efficiency and safety in their operations. We’ve been testing the security of EFBs and their apps, here’s our latest findings. TL;DR Many airlines use Lufthansa Systems Lido eRoute Manual for their EFB approach plates. We...

CVE-2023-28441

CVE-2023-28441 affects smartCARS 3 (versions 0.5.8 and earlier). The root issue is that failed login attempts cause passwords to be stored in error logs. This vulnerability is not present in version 0.5.9. A practical workaround is to delete the affected log file and ensure login is performed cor...

PT-2023-21724 · Unknown · Smartcars 3

Name of the Vulnerable Software and Affected Versions: smartCARS 3 versions 0.5.8 and prior Description: The issue affects smartCARS 3, a flight tracking software. In the affected versions, failed login attempts result in passwords being stored in error logs. This does not occur in version 0.5.9...

The US Air Force Is Moving Fast on AI-Piloted Fighter Jets

After successful autonomous flight tests in December, the military is ramping up its plans to bring artificial intelligence to the skies...

Serious DJI Drones Flaws Could Crash Drones Mid-flight

By Habiba Rashid During their assessment, the researchers discovered a total of 16 vulnerabilities with a broad range of impacts, from denial of service to arbitrary code execution. This is a post from HackRead.com Read the original post: Serious DJI Drones Flaws Could Crash Drones Mid-flight...

Causing incidents with in-flight entertainment systems

Some odd things have happened on airplanes recently. The voice on the PA system on an American Airlines flight was one of these. Before the airline put out a response, we were asked to speculate about how it might have happened. American then discovered that there was an issue with one of the PA...

Enter the Hunter Satellites Preparing for Space War

True Anomaly, a startup backed by US senator JD Vance's VC firm, plans to launch prototype pursuit satellites on a SpaceX flight later this year...

ADS-B Exchange, the Flight Tracker That Powered @ElonJet, Sold to Jetnet

ADS-B Exchange, beloved for resisting censorship, was sold to a company owned by private equity—and now even its biggest fans are bailing...

Dated, Vulnerable, Insecure Tech Is All Over the News. Hooray.

Save the links. Pass them around. And consider getting your copy of the new 2023 XDR Buyer’s Guide—because if this isn’t a time for reckoning and progress, what is? The news: on Wednesday, the United States grounded all flights coast-to-coast for the first time since 9/11. The Federal Aviation...

CVE-2023-0281

A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file judgepanel.php. The manipulation of the argument subeventid leads to sql injection. The attack may be launched...

Sql injection

A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file judgepanel.php. The manipulation of the argument subeventid leads to sql injection. The attack may be launched...

CVE-2023-0283 SourceCodester Online Flight Booking Management System POST Parameter review_search.php sql injection

A vulnerability classified as critical has been found in SourceCodester Online Flight Booking Management System. This affects an unknown part of the file reviewsearch.php of the component POST Parameter Handler. The manipulation of the argument txtsearch leads to sql injection. It is possible to...

CVE-2023-0281

SourceCodester Online Flight Booking Management System has a SQL injection vulnerability in judge_panel.php via the subevent_id parameter. The issue is exploitable remotely and has been disclosed publicly. Several connected documents corroborate CVE-2023-0281 and describe the affected component a...

CVE-2023-0281 SourceCodester Online Flight Booking Management System judge_panel.php sql injection

A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file judgepanel.php. The manipulation of the argument subeventid leads to sql injection. The attack may be launched...