Beijing Baichuo Smart S85F Management Platform Code Issue Vulnerability

Beijing Baichuo Smart S85F Management Platform is a management platform from Beijing Baichuo Corporation. A code issue exists in Beijing Baichuo Smart S85F Management Platform 20230722 and prior versions, where the vulnerability stems from an unrestricted upload via the parameter fileupload...

Beijing Baichuo Smart S85F Management Platform Command Injection Vulnerability

Beijing Baichuo Smart S85F Management Platform is a management platform of Beijing Baichuo Company. A command injection vulnerability exists in Beijing Baichuo Smart S85F Management Platform 20230722 and earlier versions, which stems from a SQL injection vulnerability in the parameter sql of the...

prev-toyama.smart-element.net Cross Site Scripting vulnerability OBB-3566195

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-33383

Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload...

CVE-2023-33383

Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload...

Out-of-bounds

Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload...

CVE-2023-33383

CVE-2023-33383 affects Shelly 4PM Pro four-channel smart switch, firmware version 0.11.0. The vulnerability is a BLE out-of-bounds read fault condition that can trigger a device reload. Multiple connected sources (Red Hat advisory, NVD entry, CVE listings, Exploit-DB page) corroborate an out-of-b...

WordPress The Smart Slider 3 Plugin < 3.5.0.9 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextendweb:smartslider3"; if description...

Unauthorized Admin Transfer Vulnerability

Lines of code Vulnerability details Description The bug in this contract is that it doesn't handle the case when the pendingAdmin is set to the zero address address0. As per the condition msg.sender == address0, the if statement can be bypassed if an attacker sets pendingAdmin to the zero address...

Privacy Violation: Unauthorized Access to Blocking Status of Profiles

Lines of code Vulnerability details Impact The smart contract contains a critical privacy violation that allows unauthorized users to access the blocking status of profiles. The isBlocked function, which is intended to check if one profile is blocked by another, lacks proper access controls and...

Lack of Preventing Multiple Follows to the Same Profile ID

Lines of code Vulnerability details Impact The absence of a check for multiple follows to the same profile ID poses a significant security and integrity risk for the smart contract. By exploiting this vulnerability, a malicious user could inflate the number of followers for a particular profile I...

WordPress Meks Smart Social Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Meks Smart Social Widget Type Plugin Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25989 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b2f058eee5d5 Credits Muhammad Daf...

smart-robotics.io Cross Site Scripting vulnerability OBB-3549031

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cisco Multiple Vulnerabilities in NX-OS-Based Products (CVE-2014-3261)

Buffer overflow in the Smart Call Home implementation in Cisco NX-OS on Fabric Interconnects in Cisco Unified Computing System 1.4 before 1.41i, NX-OS 5.0 before 5.03U22 on Nexus 3000 devices, NX-OS 4.1 before 4.12E11l on Nexus 4000 devices, NX-OS 5.x before 5.13N11 on Nexus 5000 devices, NX-OS 5...

Security Bulletin: Netplex json-smart-v2 is vulnerable to CVE-2023-1370 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Netplex json-smart-v2 which is vulnerable to CVE-2023-1370. Vulnerability Details CVEID:CVE-2023-1370 DESCRIPTION: netplex json-smart-v2 is vulnerable to a denial of service, caused by not limiting the nesting of arrays or objects. By...

CVE-2023-3836

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePointaddImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated...

CVE-2023-3836

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePointaddImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated...

Out-of-bounds

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePointaddImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated...

CVE-2023-3836

CVE-2023-3836 affects Dahua Smart Park Management prior to 20230713. Multiple connected sources confirm an unrestricted/unauthorized file upload vulnerability in the endpoint /emap/devicePoint_addImgIco?hasSubsystem=true, enabling remote file upload and potentially remote code execution or full s...

CVE-2023-3836 Dahua Smart Park Management unrestricted upload

A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devicePointaddImgIco?hasSubsystem=true. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated...