[SECURITY] Fedora 33 Update: atasm-1.09-1.fc33

ATasm is a 6502 command-line cross-assembler that is compatible with the original Mac/65 macro-assembler released by OSS software. Code development can now be performed using "modern" editors and compiles with lightning speed...

lightning-server cross-site scripting vulnerability

lightning-server is a personal developer Npm library for data visualization applications . The library provides API-based access to reproducible Web-based interactive visualizations. A security vulnerability exists in all versions of lightning-server, which can be exploited by an attacker to inje...

Cross-site Scripting (XSS)

lightning-server is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser via an error message in the session controller's addData function...

CVE-2020-26895

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

CVE-2020-26896

Prior to 0.11.0-beta, LND Lightning Network Daemon had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount...

CVE-2020-26895

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

Design/Logic Flaw

Prior to 0.11.0-beta, LND Lightning Network Daemon had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount...

Open redirect

Prior to 0.10.0-beta, LND Lightning Network Daemon would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation e.g., routing node, payment-receiver,...

CVE-2020-26896

The CVE affects LND (Lightning Network Daemon) prior to version 0.11.0-beta, specifically its invoice database. The root cause is that, when claiming an on-chain HTLC output, LND did not verify that the corresponding off-chain HTLC had already been settled before releasing the preimage. In a hash...

CVE-2020-26895

CVE-2020-26895 affects LND versions prior to 0.10.0-beta. The root cause is the handling of a counterparty high-S signature which could lead to the broadcast of invalid local commitment/HTLC transactions. This allows any peer with an open channel—whether routing node, payment-sender, or payment-r...

PT-2020-16537 · Lightning Network Daemon · Lnd

Name of the Vulnerable Software and Affected Versions: LND versions prior to 0.10.0-beta Description: The issue allows any peer with an open channel to exploit the vulnerability, regardless of the victim's situation, such as being a routing node, payment-receiver, or payment-sender. This can lead...

PT-2020-16538 · Lightning Network · Lnd

Name of the Vulnerable Software and Affected Versions: LND Lightning Network Daemon versions prior to 0.11.0-beta Description: The issue concerns a problem in the invoice database where LND failed to verify the settlement of an outgoing off-chain HTLC before releasing the preimage while claiming ...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747

CVE-2020-7747 – Cross-site Scripting in lightning-server (session controller) . Several connected sources confirm that lightning-server is vulnerable to XSS across all versions, allowing injection of malicious JavaScript via the session controller. A PoC demonstrates posting a crafted payload in ...

CVE-2020-7747 Cross-site Scripting (XSS)

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

Cross-site Scripting (XSS)

Overview lightning-server is a lightning dataviz notebooks server. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to inject malicious JavaScript code as part of a session controller. PoC POST...

Fedora 32 : seamonkey (2020-15999f707a)

Update to 2.53.4 Lightning, Chatzilla and DOM Inspector are now provided in the same way as for themes and language packs ie. as 'application global' addons. Previously, they were copied into the user profile on each update, which led to some issues. The old copies of those addons are automatical...

Fedora 31 : seamonkey (2020-3813e1317b)

Update to 2.53.4 Lightning, Chatzilla and DOM Inspector are now provided in the same way as for themes and language packs ie. as 'application global' addons. Previously, they were copied into the user profile on each update, which led to some issues. The old copies of those addons are automatical...

lightningmaps.org Cross Site Scripting vulnerability OBB-1235778

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...