mp-solncem.ru Cross Site Scripting vulnerability OBB-2574191

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Unbreakable Enterprise kernel security update

4.14.35-2047.512.6 - Revert 'rds/ib: recover rds connection from stuck rx path' Rohit Nair Orabug: 34039271 - uek-rpm: update kABI lists for new symbols Saeed Mirzamohammadi Orabug: 33993774 4.14.35-2047.512.5 - netfilter: nftables: initialize registers in nftdochain Pablo Neira Ayuso Orabug:...

mp-schmuck.ch Cross Site Scripting vulnerability OBB-2551163

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-G5RR-P69H-7V3G Insufficient type validation in pocketmine/pocketmine-mp

Impact When an inventory interaction is performed e.g. moving an item around an inventory, the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involv...

Insufficient type validation in pocketmine/pocketmine-mp

Impact When an inventory interaction is performed e.g. moving an item around an inventory, the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involv...

Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown

Impact LoginPacket uses BinaryStream-getLInt to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream-getLInt returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size which would be interpreted as a...

GHSA-5JFW-35XP-5M42 Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown

Impact LoginPacket uses BinaryStream-getLInt to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream-getLInt returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size which would be interpreted as a...

The vulnerability of the genmp_writefontmacro_latex function in the genmp.c component of the Fig2dev file conversion utility allows a hacker to cause a service failure.

The vulnerability of the genmpwritefontmacrolatex function in the genmp.c component of the xfig conversion utility for .fig files in Fig2dev relates to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to cause a service failure by converting...

NaN/INF in serverbound movement packets can crash clients and servers

Impact A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play. - The server may crash in various ways if this exploit is use...

GHSA-FM35-JGG3-3GRX NaN/INF in serverbound movement packets can crash clients and servers

Impact A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play. - The server may crash in various ways if this exploit is use...

mp.gov.my Cross Site Scripting vulnerability OBB-2429922

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Insecure Encryption

pocketmine/pocketmine-mp is using insecure encryption. The vulnerability exists in 'Minecraft Bedrock' function, due to authentication and protocol encryption are unchangeable servers are allowed to connect internet directly...

GHSA-H79X-98R2-G6QC Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP

Impact Minecraft Bedrock authentication and its protocol encryption are inseparably linked. One is not complete without the other. This vulnerability affects servers which are able to be directly connected to via the internet i.e. not behind a proxy. If you are using a proxy, please check that it...

CVE-2022-22180 Junos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packets

An Improper Check for Unusual or Exceptional Conditions vulnerability in the processing of specific IPv6 packets on certain EX Series devices may lead to exhaustion of DMA memory causing a Denial of Service DoS. Over time, exploitation of this vulnerability may cause traffic to stop being...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service DoS. The vulnerability exists as the handleBookEdit class does not limit the size of pages and characters to be fill. which allows an attacker to cause an application crash...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The library does not properly validate byte limit in the skin length resulting in an overflow, allowing an attacker to crash the application...

CVE-2021-27856

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002...

DEBIAN-CVE-2021-43618

GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inpraw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

mp-trans.com.pl Improper Access Control vulnerability OBB-2256288

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

XnView MP Buffer Overflow Vulnerability (CNVD-2021-95260)

XnView MP is a set of image viewing software that is an enhanced version of XnView Classic. The software can be used to view, convert, organize and edit graphics and video files.XnView MP suffers from a buffer overflow vulnerability, which can be exploited by attackers to cause a denial of servic...