374 matches found
CVE-2024-7647 OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing or incorrect nonce validation on the otasyncwidgetsettingsfnc function. This makes it possible for unauthenticated attackers to...
WordPress OTA Sync Booking Engine Widget plugin <= 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Ala Arfaoui in WordPress Plugin OTA Sync Booking Engine Widget versions = 1.2.7...
WordPress plugin OTA Sync Booking Engine Widget 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress OTA Sync Booking Engine Widget Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
Software OTA Sync Booking Engine Widget Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7647 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID d35ee6f2779f Credits Ala...
CVE-2024-23352 Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA...
CVE-2024-23352 Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA...
CVE-2024-23352
CVE-2024-23352 concerns a transient DoS in Qualcomm closed‑source components due to a loop in the Multi Mode Call Processor. The issue manifests when NAS receives ODAC criteria of length 1 and type 1 during registration (OTA). Public documents consistently cite the description, but no concrete pa...
CVE-2023-6321
A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability...
CVE-2023-6321
The CVE-2023-6321 issue is described across connected sources as a command-injection vulnerability in the IOCTL handler that manages OTA updates on Owlet Cam OS. The underlying flaw allows an authenticated attacker to execute commands with root privileges, potentially taking full control of affec...
CVE-2023-6321 Owlet Camera OS command injection
A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability...
CVE-2023-6321 Owlet Camera OS command injection
A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability...
JVN#62737544: Multiple vulnerabilities in RoamWiFi R10
RoamWiFi R10 provided by RoamWiFi Technology Co., Ltd. contains multiple vulnerabilities listed below. Active debug code CWE-489 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 8.8 CVE-2024-31406 Insertion of sensitive information into log file CWE-532...
ota-goods.info Cross Site Scripting vulnerability OBB-3889567
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ota-goods.info Cross Site Scripting vulnerability OBB-3873145
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-41827
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...
Input validation
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...
CVE-2023-41827
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI...
CVE-2023-41827
CVE-2023-41827 affects the Motorola OTA update application with an improper export vulnerability that could allow a local malicious app to inject an HTML-based message into the device UI. The NVD metrics show CVSS 3.1: 5.1 (Medium), attack vector LOCAL, no user interaction required, and scope UNC...