WWBN AVideo Security Breach

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo, which originates from an information disclosure vulnerability in the chunkFile path method of the aVideoEncoder.json.php page...

WWBN AVideo Cross-Site Scripting Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo, which stems from a cross-site scripting xss vulnerability in the user name method of the channelBody.php page...

Tenda AX1803 安全漏洞

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX1803 v1.0.0.1, which originates from the adv.iptv.stballvlans parameter of the getIptvInfo method failing to correctly validate the length of the input data, and can be exploited b...

CVE-2024-0301

A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The...

PrestaShop cross-site scripting vulnerability (CNVD-2024-03224)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop versions prior to 8.1.3. Th...

Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the ResponseParser...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an Improper Access Control vulnerability, which stems from an Improper Access Control vulnerability in the Xiao Yi Input Method...

view_component Cross-site Scripting vulnerability

Impact What kind of vulnerability is it? Who is impacted? This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the viewcomponent gem. Note that only components that define a call method i.e. instead of using a sidecar template...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' via the call and outputpostamble methods. An attacker can inject malicious scripts that may be executed in the context of the user's browser session by...

Ruby on Rails: XSS when using `translate` in Action Controller (Rails 7.0, 7.1)

The vulnerability allows cross-site scripting XSS when using the translate method in Action Controller in Rails versions 7.0 and 7.1. The vulnerability was caused by the implementation of translate in Action Controller, which did not properly escape the values passed to it. The vulnerability was...

PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)

Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer sessio...

CVE-2023-50090

Affected product: ureport2, version 2.2.9 and earlier. Vulnerability: Arbitrary File Write in the saveReportFile method, exploitable via crafted POST requests; enables writing arbitrary files and running arbitrary commands. Impact: high confidentiality, integrity, and availability risks; CVSS v3....

The Definitive Enterprise Browser Buyer's Guide

Security stakeholders have come to realize that the prominent role the browser has in the modern corporate environment requires a re-evaluation of how it is managed and protected. While not long-ago web-borne risks were still addressed by a patchwork of endpoint, network, and cloud solutions, it ...

Mozilla: Use-after-free in <code>nsDNSService</code>

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start-up...

Mobile malware analysis for the BBC

This is a version of our report referenced in the Helping a mobile malware fraud victim blog post, with all sensitive information removed. Summary One malicious application was identified on the device, and evidence identified during the examination strong suggests though this cannot be confirmed...

PT-2026-5402

Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A flaw exists in Undertow where servlets utilizing a method that calls HttpServletRequestImpl.getParameterNames may experience an OutOfMemoryError when handling client requests with...

CVE-2023-51006

An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors...

CVE-2023-51006

An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors...

CVE-2023-51006

An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors...

Tenda M3 TendaTelnet Method Command Execution Vulnerability

Tenda M3 is an access controller from Tenda, China. A command execution vulnerability exists in Tenda M3 version V1.0.0.124856, which stems from the failure of the TendaTelnet method to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited to...