4960 matches found
Samsung SMR 安全漏洞
Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to Samsung SMR Nov-2021 Release 1, which stems from the presence of sensitive information in property settings that can be exploit...
Deoxxa dotty 安全漏洞
Deoxxa Dotty is a Javascript-based code base used by Deoxxa individual developers to support access to object properties. deoxxa dotty has a security vulnerability that stems from a design or implementation impropriety in the code development process of a web-based system or product. No details o...
byronbaypropertysales.com.au Cross Site Scripting vulnerability OBB-2217247
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
property-star.com Improper Access Control vulnerability OBB-2201883
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2021-15534 · X-Assign · X-Assign
Name of the Vulnerable Software and Affected Versions: x-assign versions all Description: The issue affects the global proto object, which can be polluted using the proto object. This allows for potential manipulation of the object's properties. Recommendations: For all versions, consider...
Microsoft Warns of Iran-Linked Hackers Targeting US and Israeli Defense Firms
An emerging threat actor likely supporting Iranian national interests has been behind a password spraying campaign targeting U.S., E.U., and Israeli defense technology companies, with additional activity observed against regional ports of entry in the Persian Gulf as well as maritime and cargo...
How nation-state attackers like NOBELIUM are changing cybersecurity
This is the first post in a four-part series on the NOBELIUM nation-state cyberattack. Microsoft started telling the industry about this extremely advanced cyberattack in December 2020. The NOBELIUM blog series—which mirrors Microsoft’s four-part video series “Decoding NOBELIUM”—will pull the...
caseylooproperty.com Cross Site Scripting vulnerability OBB-2144819
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Europol Busts Major Crime Ring, Arrests Over 100 Online Fraudsters
Law enforcement agencies in Italy and Spain have dismantled an organized crime group linked to the Italian Mafia that was involved in online fraud, money laundering, drug trafficking, and property crime, netting the gang about €10 million $11.7 million in illegal proceeds in just a year. "The...
Denial of Service Vulnerability in Gbase 8a
GBase 8s is a secure database management system with full intellectual property rights. A denial-of-service vulnerability exists in Gbase 8a, which can be exploited by an attacker to cause the program to crash...
Linux Implementation of Cobalt Strike Beacon Targeting Organizations Worldwide
Researchers on Monday took the wraps off a newly discovered Linux and Windows re-implementation of Cobalt Strike Beacon that's actively set its sights on government, telecommunications, information technology, and financial institutions in the wild. The as-yet undetected version of the penetratio...
Improper Handling of Missing Values in kaml
Impact Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with t...
CVE-2021-39194
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in...
Prototype Pollution
objection is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the set and zipObject function...
Design/Logic Flaw
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of...
CVE-2021-40523
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of...
Prototype Pollution in Proto
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function...
Immer 代码问题漏洞
Immer is a Javascript-based state management library from the Immer community. A code issue vulnerability exists in Immer that stems from the product's susceptibility to improper control of object prototype properties. The vulnerability can be exploited by an attacker to cause information...
Prototype Pollution in open-graph
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload...