5994 matches found
Authorization
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...
petsaversshreveport.org Cross Site Scripting vulnerability OBB-2799652
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
globalasia.org Cross Site Scripting vulnerability OBB-2790218
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
[SECURITY] Fedora 35 Update: asnip-0-0.6.20200618git44ba98b.fc35
Asnip retrieves all IPs used by an organization for surface mapping. It uses the IP or domain name and looks up the Autonomous System Number ASN, retrieves the Classless Inter-Domain Routing CIDR subnet masks and converts them to IPs...
CVE-2021-27294
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
cscda.org Cross Site Scripting vulnerability OBB-2767418
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Stripe: Mass account takeover!
@akashhamal0x01 discovered an Organization Owner could update the email address of a member of their organization in TaxJar. This could have allowed an attacker to take over a victim’s account if the victim belonged to the attacker’s organization. The vulnerability was caused by the ability to ed...
mavoisatum.org Cross Site Scripting vulnerability OBB-2762101
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Tech support scammers caught by their own cameras
A Youtuber has hacked into the CCTV cameras of an office used by tech support scammers and reported them to the police. The video feed of what is going on in that office ends with the arrest of the scammers. CCTV The Youtuber, acting under the handle Scambaiter, turned his attention to Punjab in...
CVE-2021-33914
CVE-2021-33914 is detailed in Veracode as a denial-of-service vulnerability in libspf2, caused by an uncaught floating-point exception in ACLosslessScan::ParseMCU (aclosslessscan.cpp) that can crash the application. The connected Alpine entry is a placeholder reserved record with no new technical...
stembrasil.org Cross Site Scripting vulnerability OBB-2720889
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-27627
Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser...
CVE-2022-27627
Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser...
nobleminds.org Cross Site Scripting vulnerability OBB-2716528
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
employindy.org Cross Site Scripting vulnerability OBB-2711266
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2015-4136
The CVE-2015-4136 entry is supported by Atlassian advisories BAM-16023 (and BAM-16023 cross‑references) describing a vulnerability in Bamboo 5.8.0/5.8.1 where the Windows Stock Image (Windows Server 2012 R2) AMI included a publicly known password for the ‘bamboo’ user. This allowed SSH access to ...