BIT-GOLANG-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2024-25615

An unauthenticated Denial-of-Service DoS vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service...

PT-2024-18883 · Unknown · Sourcecodester Online Mobile Management Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Mobile Management Store version 1.0 Description: A vulnerability was found in the software, affecting an unknown functionality of the file "/?p=products". The manipulation of the search argument leads to cross-site...

p-lilas.net Improper Access Control vulnerability OBB-3860199

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

i-p-c.net Improper Access Control vulnerability OBB-3858391

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-23342 python-ecdsa vulnerable to Minerva attack on P-256

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

Minerva timing attack on P-256 in python-ecdsa

python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the ecdsa.SigningKey.signdigest API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH...

n-p-s.net Cross Site Scripting vulnerability OBB-3837592

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EulerOS Virtualization 2.10.1 : openssl (EulerOS-SA-2023-3507)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the...

PT-2024-15459 · Inis · Inis

Name of the Vulnerable Software and Affected Versions: Inis versions up to 2.0.1 Description: A critical issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument p url leads to server-side request forgery. The attack may be initiated...

ZTE ZXCLOUD iRAI Code Injection Vulnerability

The ZTE ZXCLOUD iRAI is a virtualization appliance from China's ZTE Corporation ZTE. A security vulnerability exists in ZTE ZXCLOUD iRAI version 7.22.11P2 and prior versions, which stems from the program's inability to adequately validate user input. An attacker can exploit the vulnerability to...

NetApp ONTAP Information Disclosure Vulnerability

NetApp ONTAP is a proprietary operating system from Network Appliance NetApp, Inc. It is used for storage disk arrays. An information disclosure vulnerability exists in NetApp ONTAP 9 versions 9.12.1P8, 9.13.1P4 and 9.13.1P5, which stems from the presence of a sensitive information disclosure...

p-mans.net Cross Site Scripting vulnerability OBB-3811601

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

AZL-35167 CVE-2023-2861 affecting package qemu for versions less than 8.2.0-1

A flaw was found in the 9p passthrough filesystem 9pfs implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder...

DEBIAN-CVE-2023-2861

A flaw was found in the 9p passthrough filesystem 9pfs implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder...

r-p-n.de Improper Access Control vulnerability OBB-3775108

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bsm-p-hege.de Improper Access Control vulnerability OBB-3774671

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

TP-LINK Tapo C100 Denial of Service Vulnerability

TP-LINK Tapo C100 is a webcam device from China P&L TP-LINK. The TP-LINK Tapo C100 suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by an attacker to cause a denial of service DoS by serving a crafted web request...

p-z-e.de Improper Access Control vulnerability OBB-3770688

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

p-diddy.com Cross Site Scripting vulnerability OBB-3770042

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...