12021 matches found
motolandshop.de Cross Site Scripting vulnerability OBB-2731222
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
HackerOne Fires Employee for Stealing Bug Reports, Collecting Bug Bounties
By Deeba Ahmed Bug bounty and vulnerability coordination platform HackerOne has fired an employee for using their position to access customers… This is a post from HackRead.com Read the original post: HackerOne Fires Employee for Stealing Bug Reports, Collecting Bug Bounties...
Attacker may front-run acceptCounterOffer() cause users to take both original order and new one
Lines of code Vulnerability details Impact Function PuttyV2.acceptCounterOffer is used in case users see better deal and want to cancel their own order before filling the new one. But attacker can abuse this function by front-run calling fillOrder before it is cancelled in acceptCounterOffer...
OSV-2022-529 Heap-buffer-overflow in init_mt
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48609 Crash type: Heap-buffer-overflow WRITE Crash state: initmt vp9decodeframe vp9receivecompresseddata...
File Protocol Spoofing
Description parse-url misinterpreting the file:// protocol when trying to match git urls. The following payload is certainly valid file protocol but is interpreted as ssh protocol. file:///etc/passwd?http://a:1:1 Proof of Concept // PoC.js const fs = require'fs'; var parseURL = require"parse-url"...
Adobe Illustrator Out-of-Bounds Reading Vulnerability (CNVD-2022-50223)
Adobe Illustrator, a vector-based image creation software from Adobe, is vulnerable to an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause a sensitive memory leak...
Arbitrary file deletion
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php...
GSD-2022-1003729 RDMA/hfi1: Fix potential integer multiplication overflow errors
RDMA/hfi1: Fix potential integer multiplication overflow errors This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...
GSD-2022-1003646 dm crypt: make printing of the key constant-time
dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.120 by commit...
GSD-2022-1003516 net: xfrm: unexport __init-annotated xfrm4_protocol_init()
net: xfrm: unexport init-annotated xfrm4protocolinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...
GSD-2022-1003452 KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak
KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...
GSD-2022-1003432 dm stats: add cond_resched when looping over entries
dm stats: add condresched when looping over entries This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...
GSD-2022-1002717 ARM: hisi: Add missing of_node_put after of_find_compatible_node
ARM: hisi: Add missing ofnodeput after offindcompatiblenode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...
Cloudflare Public Bug Bounty: Basic XSS [WAF Bypasses]
Vulnerability description not provided...
an-electrorecycling.de Cross Site Scripting vulnerability OBB-2688304
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
Stored XSS in EditEstadoDocumento
Description In facturascripts/EditEstadoDocumento, the field Icon can be injected an XSS payload into it. Proof of Concept // PoC.js POST /facturascripts/EditEstadoDocumento?code=27&action=save-ok HTTP/1.1 Host: 127.0.0.1 Content-Length: 1224 Cache-Control: max-age=0 sec-ch-ua:...
MAL-2022-7260 Malicious code in x3-stock-graphql-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80cd5e1c9d72642b5cf61b5bf0d49e2b32267885c173a08e5bb0ef28124885e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3670 Malicious code in hope-session-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0192abad16c59c0d9aa7427749f757e03eb834f871ba0cf5bf0bb75725d9fab1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...