JVN#40613060: Multiple vulnerabilities in WNC01WH

WNC01WH provided by BUFFALO INC. is a network camera. WNC01WH contains multiple vulnerabilities listed below. Denial-of-service DoS - CVE-2016-7821 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H| Base Score: 6.5 CVSS v2| AV:N/AC:H/Au:N/C:N/I:N/A:C| Base...

Mozilla Firefox < 50.0.2 nsSMILTimeContainer.cpp SVG Animation RCE (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.0.2. It is, therefore, affected by a use-after-free error in dom/smil/nsSMILTimeContainer.cpp when handling SVG animations. An unauthenticated, remote attacker can exploit this issue, via a specially...

OWOX, Inc.: Access to Grafana Dashboard

Hi, I was looking at the office.owox.com on port 3000 Grafana webapp. I'm not sure if it is for demo purposes, but I can access the main dashboard and view all graphs. I am also able to sign in and create my own organizations, dashboards etc. I searched on the net for any reference to this web...

OWOX, Inc.: Subdomain Takeover on OWOX.RU

Subdomain http://www.owox.ru/ was preserved from being taken over by an attacker: https://kiosk.owox.ru/ https://blog.owox.ru/...

Biesta Billing 4.0 Beta Cross Site Request Forgery / Traversal

| \ | | / | | | | | | | | | | | | ' \ / \ \ / / | | | | || | | | | | | / |/ ,|| ||// || Document Title: =============== Blesta Billing 4.0 Beta Multiple Vulnerabilities Credits & Authors: ================== TaurusOmar - @TaurusOmar [email protected] taurusomar.buhosec.com Product &...

JVN#20252219: kintone mobile for Android fails to verify SSL server certificates

kintone mobile for Android provided by Cybozu, Inc. fails to verify SSL server certificates in WebView. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provid...

OWOX, Inc.: Subdomain Takeover on http://blog.owox.com/

Subdomain Takeover via http://blog.owox.com Subdomain Takeover via http://blog.owox.com...

Ubiquiti Inc.: Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software.

In UniFi Cloud Key versions prior to 5.3.12, 5.4.9 and 5.5.2, the firmware is downloaded in a unprotected channel, with allow an attacker in an MitM scenario to interfere with the communication, and possibly modifying the firmware during an update. The versions 5.3.12, 5.4.9 and 5.5.2 fix this...

OWOX, Inc.: ClickJacking

hi there ! i have found clickjacking vulnerability in your website you should set the frames to fix the issue...

OWOX, Inc.: Subdomain Takeover on http://kiosk.owox.com/

Subdomain http://kiosk.owox.com/ was preserved from being taken over by an attacker...

mail.advantech-inc.com XSS vulnerability

Open Bug Bounty ID: OBB-193060 Description| Value ---|--- Affected Website:| mail.advantech-inc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Moderate: Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Juno for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Moderate: Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 Kilo for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Null pointer dereference

Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service application crash" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting t...

CVE-2016-9294

Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service application crash" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting t...

CVE-2016-9294

Artifex MuJS (jscompile.c) contains a vulnerability in which a malformed labeled break/continue can cause a NULL pointer dereference, enabling a denial-of-service via application crash. Affected: MuJS prior to the commit 5008105780c0b0182ea6eda83ad5598f225be3ee (and MuJS versions 1.0.0–1.3.1 per ...

CVE-2016-9294

Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service application crash" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting t...

CVE-2016-9294

Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service application crash" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting t...

Ubiquiti Inc.: Subdomain Takeover (moderator.ubnt.com)

Hello Team This report is same as 179110 One of your subdomain http://moderator.ubnt.com is pointing towards 216.58.203.243 moderator.ubnt.com 216.58.203.243 ghs.google.com 216.58.203.243 ghs.l.google.com F134183 And it is unclaimed When I open it it is showing F134184 Impact :- An attacker can...

JVN#92237169: CG-WLR300NX vulnerable to cross-site scripting

CG-WLR300NX provided by Corega Inc is a wireless LAN router. CG-WLR300NX contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Update to the latest version of firmware according to the information...