766 matches found
CVE-2019-18925
Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication...
CVE-2019-18925
The records consistently identify an authentication bypass in Systematic IRIS WebForms 5.4, where “its functionalities can be accessed and used without any form of authentication.” Red Hat and NVD corroborate this as CVE-2019-18925, with a high/critical impact profile (CVSS v3.1: CRITICAL, base s...
CVE-2019-18926
Systematic IRIS Standards Management ISM v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting XSS. A user input related to dialog information is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack against users of the...
CVE-2019-18926
CVE-2019-18926 affects Systematic IRIS Standards Management (ISM) v2.1 SP1 89. It is vulnerable to unauthenticated reflected XSS via a user input (dialog information) reflected in the page. The Red Hat/NVD entries confirm the same description. No explicit exploit details or remediation are provid...
CVE-2019-18924
CVE-2019-18924 affects IRIS WebForms 5.4. The root cause is a directory-traversal flaw: manipulating file-referencing variables with ../ and variations allows listing directories and checking for file existence. Exploitation or in-wild details are not provided in the connected documents. Remediat...
CVE-2019-18924
Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ and variations, it is possible to list all the directories and check if a particular file exists...
CVE-2019-18926: Improper Neutralization of Input During Web Page Generation
Systematic IRIS Standards Management ISM v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting XSS. A user input related to dialog information is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack against users of the...
CVE-2019-18924: Improper Limitation of a Pathname to a Restricted Directory
Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ and variations, it is possible to list all the directories and check if a particular file exists...
CVE-2019-18925: Missing Authentication for Critical Function
Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication...
regiocast.api.iris.radiorepo.io Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-956839 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Iris - WinDbg Extension To Perform Basic Detection Of Common Windows Exploit Mitigations
Iris WinDbg extension performs basic detection of common Windows exploit mitigations 32 and 64 bits. The checks implemented, as can be seen in the screenshot above, are for the loaded modules: DynamicBase ASLR DEP SEH SafeSEH CFG RFG GS AppContainer If you don't know the meaning of some of the...
'Unhackable' Biometric USB Offers Up Passwords in Plain Text
A USB stick dubbed eyeDisk that uses iris recognition to unlock the drive claims to be “unhackable” – only, it isn’t. In fact, a simple Wireshark analysis revealed the device’s password – in plain text. David Lodge of Pen Test Partners noticed the product on Kickstarter, where it amassed enough...
eyeDisk. Hacking the unhackable. Again
Last year, about the time we were messing around with a virtually unheard-of hardware wallet we got a bit excited about the word “unhackable”. Long story short, I ended up supporting a selection of kickstarters that had the word “unhackable” or similar in their title. Of these, at least one got...
Information Leakage Vulnerability in Technology Management System of Iris Software (Shenzhen) Co.
Iris Software Shenzhen Limited Technology Management System is a capital project management software. There is an information leakage vulnerability in the Technology Management System of Iris Software Shenzhen Co. Ltd. that can be exploited by attackers to obtain sensitive information...
iris-rail.org XSS vulnerability
Open Bug Bounty ID: OBB-702388 Description| Value ---|--- Affected Website:| iris-rail.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...
iris-rail.org XSS vulnerability
Open Bug Bounty ID: OBB-670384 Description| Value ---|--- Affected Website:| iris-rail.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
iris-rail.org XSS vulnerability
Open Bug Bounty ID: OBB-652006 Description| Value ---|--- Affected Website:| iris-rail.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2017-2901
An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the applicatio...
DEBIAN-CVE-2017-2901
An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the applicatio...
CVE-2017-2901
An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the applicatio...