129 matches found
ravinesassoc.org Cross Site Scripting vulnerability OBB-2348241
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client
A flaw was found in jboss-remoting. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code,...
CVE-2021-3319
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions = v2.4.0 contain NULL Pointer Dereference CWE-476, Attempt to Access Child of a Non-structure Pointer CWE-588. For more information, see...
Cross Site Scripting (XSS)
zoneminder:edge is vulnerable to Cross Site Scripting XSS. It exists in ZoneMinder, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...
CVE-2021-40540
ulfiusurilogger in Ulfius HTTP Framework before 2.7.4 omits coninfo initialization and a coninfo-request NULL check for certain malformed HTTP requests...
UBUNTU-CVE-2020-36420
Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2021-1687)
According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mod...
cxf: OpenId Connect token service does not properly validate the clientId
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...
[SECURITY] [DLA 2452-2] libdatetime-timezone-perl regression update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2452-2 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 17, 2020 https://wiki.debian.org/LTS -...
ultra-saas.com Cross Site Scripting vulnerability OBB-1496968
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
intershop.lv Cross Site Scripting vulnerability OBB-1457454
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
email-how.com Cross Site Scripting vulnerability OBB-1381800
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
aboutboulder.com Cross Site Scripting vulnerability OBB-1321426
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
schlossgeischtschraenzer.ch Cross Site Scripting vulnerability OBB-1278735
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
tiktakhodinky.sk Cross Site Scripting vulnerability OBB-1237597
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-14212
FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...
shopping.st-mary.org.tw Cross Site Scripting vulnerability OBB-1193420
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
cxf: OpenId Connect token service does not properly validate the clientId
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...
cxf: OpenId Connect token service does not properly validate the clientId
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...
CVE-2021-3319
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions = v2.4.0 contain NULL Pointer Dereference CWE-476, Attempt to Access Child of a Non-structure Pointer CWE-588. For more information, see...