CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

Cross site scripting

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

Path traversal

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16485

CVE-2018-16485 describes a directory traversal vulnerability in the m-server Node.js module prior to version 1.4.1. The flaw arises because the server constructs targetPath with req.url using path.join and then serves the file without sanitizing the path, enabling an attacker to read arbitrary fi...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16484

The CVE-2018-16484 entry concerns m-server prior to 1.4.2, where filenames displayed in directory listings are not escaped, allowing stored XSS via crafted filenames to execute malicious JavaScript/HTML. Affected component: m-server (module used for static HTTP serving); root cause: lack of escap...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...

CVE-2018-19023

Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state...

CVE-2018-19023

CVE-2018-19023 affects Hetronic Nova-M transmitters (prior to firmware r161) with fixed codes that can be sniffed and replayed to control receivers. ZDI-ZDI-19-003-03 details remote command replay via capture-replay without authentication; impact includes unauthorized command execution and device...

Hetronic Nova-M Replay Attack Vulnerability

This vulnerability allows remote attackers to issue commands on vulnerable installations of Hetronic equipment. Authentication is not required to exploit this vulnerability. The specific flaw exists with the communication between the transmitter and receiver pair. By using a fixed control code an...

Fedora 28 : visualboyadvance-m (2018-9fc46b45ab)

Fixed 2.1.0 update, includes security fixes and added performance fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Hetronic Nova-M

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Low skill level to exploit Vendor: Hetronic Equipment: Nova-M Vulnerability: Authentication Bypass by Capture-Replay 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthorized users to view commands, replay commands,...

Fedora 28 : visualboyadvance-m (2018-fde7a2f291)

Updating to new version 2.1.0. This update contains important security fixes and it is advised to update to avoid vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Fedora 29 : visualboyadvance-m (2018-7fed65638d)

Fixed 2.1.0 update, includes security fixes and added performance fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

PT-2022-13608 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.1.0-DEV Description: The issue is related to a Segmentation Fault caused by MP4Box -lsr in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.1.0-DEV, update to version 2.1.0-DEV or later t...

m-b-g.org XSS vulnerability

Open Bug Bounty ID: OBB-711966 Description| Value ---|--- Affected Website:| m-b-g.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

m-files.com XSS vulnerability

Open Bug Bounty ID: OBB-711741 Description| Value ---|--- Affected Website:| m-files.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...