CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

Buffer overflow

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

CVE-2019-13143

CVE-2019-13143 affects Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 v2.3. The issue is an HTTP parameter pollution vulnerability that allows an attacker to unbind the current lock owner and bind themselves using the user ID, user name, and the lock MAC address exposed via And...

CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

CVE-2019-13143: Improper Input Validation

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

PT-2019-13151 · Shenzhen Dragon Brothers · Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock Fb50

Name of the Vulnerable Software and Affected Versions: Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 version 2.3 Description: An HTTP parameter pollution issue allows attackers to unbind the existing owner of the lock and bind themselves instead, leading to complete takeover o...

Soleo: Directory Traversal + HTTP Paramater Pollution leaking SQL/LDAP credentials

Upon visiting the login page of a provider’s IP Relay client, we noticed that if someone were to click the “forgot password” link, it would bring them to a URL which appeared as the following: https://./IPRelayApp/servlet/IPRelay?page=forgotPassword When attempting to modify the "page" GET...

carsforsale.motortrend.com XSS vulnerability

Open Bug Bounty ID: OBB-643617 Description| Value ---|--- Affected Website:| carsforsale.motortrend.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

manuales.cursoscnc.com XSS vulnerability

Open Bug Bounty ID: OBB-620244 Description| Value ---|--- Affected Website:| manuales.cursoscnc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

usnewsglobaleducation.com XSS vulnerability

Open Bug Bounty ID: OBB-619845 Description| Value ---|--- Affected Website:| usnewsglobaleducation.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dredge7inn.com XSS vulnerability

Open Bug Bounty ID: OBB-619668 Description| Value ---|--- Affected Website:| dredge7inn.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fallbrookchamberofcommerce.org XSS vulnerability

Open Bug Bounty ID: OBB-609322 Description| Value ---|--- Affected Website:| fallbrookchamberofcommerce.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Slack: HTTP parameter pollution from outdated Greenhouse.io JS dependency

Slack's career page was using an outdated Greenhouse JavaScript dependency which resulted in an HTTP parameter pollution vulnerability. This would have allowed the loading of external Greenhouse forms not owned by Slack. We updated the Javascript and the issue is resolved. Thanks @irvinlim! The...

gbstamp.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-597261 Description| Value ---|--- Affected Website:| gbstamp.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-8535

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

Design/Logic Flaw

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

CVE-2016-8535

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

CVE-2016-8535: Improper Input Validation

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms

Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...

auto24.ee XSS vulnerability

Vulnerable URL: http://www.auto24.ee/new/list.php?dmake=10mvid=2100%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 14.03.2016 Latest check for patch:| 14.03.2016 19:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...