17606 matches found
Ross Anderson
Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge. I cant remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and...
hamsheregallery.co.uk Cross Site Scripting vulnerability OBB-3891175
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2024-23489 · Unknown · Maurice Spin 360 Deg/3D Model Viewer
Name of the Vulnerable Software and Affected Versions: Maurice Spin 360 deg and 3D Model Viewer versions 1.2.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...
CVE-2024-30491
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8...
shop.deodatosrl.it Cross Site Scripting vulnerability OBB-3889562
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
pointdujour-international.com Cross Site Scripting vulnerability OBB-3889560
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ROS-20240328-11
The vulnerability in Curl is related to the installation of "supercookie files" in Curl, which are then passed back to a to more sources. Exploitation of the vulnerability could allow an attacker acting remotely to impact the confidentiality of protected information...
AI and Trust
Watch the Video on YouTube.com A 15-minute talk by Bruce Schneier...
LBT-T300-mini1 Buffer Overflow
include include define MAXLEN 256 define BUFFEROVERRUNLENGTH 50 define SHELLCODELENGTH 32 // NOP sled to increase the chance of successful shellcode execution char nopsledSHELLCODELENGTH =...
Delta Electronics DIAEnergie Handler_CFG.ashx Script SQL Injection Vulnerability
Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China, for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and...
CVE-2024-29059
creationtimestamp| type| source ---|---|--- 2024-03-25 13:00:53+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6850 2024-03-25 15:32:15+00:00| published-proof-of-concept| https://t.me/CNArsenal/2179 2024-03-25 15:32:50+00:00| published-proof-of-concept|...
Delta Electronics DIAEnergie GetDIAE_usList SQL Injection Vulnerability
Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China. Delta Electronics DIAEnergie GetDIAEusList suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end...
CVE-2024-29184
FreeScout before 1.8.128 is affected by a Stored XSS in the Signature Input Field. The CSP policy (script-src 'self' 'nonce-abcd') blocks inline scripts and nonces, but an attacker bypassed it by uploading a JS file via POST to /conversation/upload and then using the uploaded file’s URL as the sr...
CVE-2024-29184 FreeScout Stored XSS to Privilege Escalation After CSP Bypass
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...
CVE-2024-29273
There is Stored Cross-Site Scripting XSS in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document...
CVE-2024-28045
CVE-2024-28045 involves cross-site scripting in Delta Electronics DIAEnergie. The issue stems from improper neutralization of input, affecting DIAEnergie systems (affected versions prior to v1.10.00.005). Exploitation could enable attacker-controlled scripts to run in user browsers, potentially c...
CVE-2024-28179
CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...
CVE-2024-27286
Zulip vulnerability CVE-2024-27286 affects Zulip Server 3.0 up to (but not including) 8.3, where moving a single message from a public stream to a private stream can leave the message accessible. According to the description, the move operation could successfully relocate the message but active u...
CVE-2023-51445
GeoServer’s CVE-2023-51445 is a stored XSS in the REST Resources API. Affected versions prior to 2.23.3 and 2.24.0 allow an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources, which will execute in another administrator’s b...