409 matches found
Sipity SQL注入漏洞
Sipity is an open source plugin-ready and extensible Rails application from Hesburgh Libraries of Notre Dame. It is used to model approval-based workflows. Sipity suffers from a SQL injection vulnerability. An attacker could exploit this vulnerability to perform a sql injection attack...
dash-live 跨站脚本漏洞
dash-live is a library by Alex Ashley, a personal developer. Fake DASH Live profile endpoints using static assets. A cross-site scripting vulnerability exists in dash-live, which stems from a ready function in the static/js/media.js file of its DOM Node Handler component that allows an attacker t...
PT-2022-28049 · Unknown · Asrashley Dash-Live
Name of the Vulnerable Software and Affected Versions: asrashley dash-live affected versions not specified Description: A problematic vulnerability was found in the function ready of the file static/js/media.js of the component DOM Node Handler. This issue leads to cross-site scripting and can be...
AZL-11611 CVE-2022-3111 affecting package kernel for versions less than 5.15.86.1-1
An issue was discovered in the Linux kernel through 5.16-rc6. freechargerirq in drivers/power/supply/wm8350power.c lacks free of WM8350IRQCHGFASTRDY, which is registered in wm8350initcharger...
October 11, 2022—KB5018454 (Monthly Rollup)
None None...
CVE-2022-35899
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service GameSDK.exe 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILESX86%\ASUS\GameSDK.exe file...
Code injection
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service GameSDK.exe 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILESX86%\ASUS\GameSDK.exe file...
CVE-2022-35899
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service GameSDK.exe 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILESX86%\ASUS\GameSDK.exe file...
CVE-2022-35899
CVE-2022-35899 affects ASUSTeK Aura Ready Game SDK service (GameSDK.exe) v1.0.0.4 with an unquoted service path, enabling local privilege escalation via overwriting the binary in Program Files (x86). Public exploits/documentation exist (e.g., Exploit-DB entry) and patch v1.0.5.0 is available; rem...
PT-2022-23006 · Asustek · Asustek Aura Ready Game Sdk
Name of the Vulnerable Software and Affected Versions: ASUSTeK Aura Ready Game SDK service GameSDK.exe version 1.0.0.4 Description: The issue is related to an unquoted service path in the ASUSTeK Aura Ready Game SDK service. This might allow a local user to escalate privileges by creating a...
it.hiltoneventreadyplaybook.com Cross Site Scripting vulnerability OBB-2659332
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
June 14, 2022—KB5014748 (Monthly Rollup)
None None...
CVE-2021-3898
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...
CVE-2021-3898
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...
CVE-2021-3898
The CVE-2021-3898 issue affects Motorola Ready For and Motorola Device Help Android apps prior to 2021-04-08, caused by improper verification of server certificates. The root cause enables an attacker to access the communication channel. Reported impacts include potential confidentiality exposure...
Motorola Ready For 信任管理问题漏洞
Motorola Ready For is a feature from Motorola USA. It enhances the functionality of a cell phone by connecting it to any display or monitor1,2. A security vulnerability exists in Motorola Ready For that stems from the application's inability to properly validate server certificates. An attacker...
Phishing-kit market: what’s inside “off-the-shelf” phishing packages
What are phishing kits? One of the most common tricks scammers use in phishing attacks is to create a fake official page of a famous brand. Attackers tend to copy design elements from the real website, which is why users can find it hard to distinguish the fake pages from the official ones. Even...
CVE-2021-39173
Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges User or Admin, can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the...
ELECOM 多款产品操作系统命令注入漏洞
The Elecom ELECOM WRC and ELECOM WRH are both home-ready network cameras from Elecom Japan. A security vulnerability exists in several ELECOM products, which can be exploited by an unauthenticated, network-adjacent attacker to execute arbitrary OS commands via unspecified vectors. The following...