661 matches found
Firefly III allows webhooks HTML Injection.
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
Design/Logic Flaw
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075: Improper Neutralization of Input During Web Page Generation
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...
Firefly III Security Vulnerability
Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2024-22075
Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...
CVE-2023-28895
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
CVE-2023-28895
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
CVE-2023-28896
Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...
Hardcoded credentials
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
Design/Logic Flaw
Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...
CVE-2023-28896 Weak encoding for password in UDS services
Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...
CVE-2023-28896
The CVE-2023-28896 entry describes a vulnerability in the Modular Infotainment Platform 3 (MIB3) UDS on Škoda Superb III (3V3) 2.0 TDI (2022). The issue allows an attacker with physical access to decode UDS data transmitted over the CAN bus, indicating weak or insufficient protection of the diagn...
CVE-2023-28895 Hard-coded password for access to power controller chip memory
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
CVE-2023-28895
The CVE-2023-28895 entry concerns Škoda MIB3 infotainment’s PoWer Controller (PWC) with a hard-coded password in the firmware. This allows an attacker with physical access to gain full control of the PWC chip on Škoda Superb III (3V3) 2.0 TDI (2022). Connected documents confirm the hardware/softw...
CVE-2023-28895 Hard-coded password for access to power controller chip memory
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...
CVE-2023-28895: Use of Hard-coded Password
The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...