661 matches found
PT-2025-27306 · Volkswagen · Mib3
Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit affected versions not specified Description: An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the...
PT-2025-27309 · Volkswagen · Mib3
Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit affected versions not specified Description: A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The issue was originally discovered in...
PT-2025-27312 · Volkswagen · Mib3
Name of the Vulnerable Software and Affected Versions: MIB3 infotainment affected versions not specified Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment, resulting from the lack of proper validation of user-supplied data. This can cause an integer overflow...
CVE-2023-28912: Cleartext Storage of Sensitive Information
The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3...
CVE-2023-28910: Improper Check for Unusual or Exceptional Conditions
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number...
CVE-2023-28906: Improper Neutralization of Special Elements used in an OS Command
A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM par...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2023-0298
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0...
CVE-2023-28895
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
CVE-2023-28897
The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III 3V3 - 2.0 TDI manufactured in 2022...
CVE-2023-28898
The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain...
CVE-2023-1789
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0...
CVE-2023-1788
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6...
CVE-2022-24126
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170...
CVE-2022-24125
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted o...
CVE-2021-3728
firefly-iii is vulnerable to Cross-Site Request Forgery CSRF...
CVE-2021-3901
firefly-iii is vulnerable to Cross-Site Request Forgery CSRF...
CVE-2021-3819
firefly-iii is vulnerable to Cross-Site Request Forgery CSRF...