QNAP Systems TS-870 Cross-Site Scripting Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in PhotoStation Filenames in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of client...

Prototype Pollution

ts-dot-prop is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

ts-ingenierie.com Cross Site Scripting vulnerability OBB-1380272

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

QNAP Systems TS-870 Cross-Site Request Forgery Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site request forgery vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a WEB application that does not adequately validate that a...

openSUSE Security Update : libmediainfo / mediainfo (openSUSE-2020-1390)

This update for libmediainfo, mediainfo fixes the following issues : libmediainfo was updated to version 20.08 : Added : - MPEG-H 3D Audio full featured support group presets, switch groups, groups, signal groups - MP4/MOV: support of more metadata locations - JSON and XML outputs: authorize...

Node.js third-party modules: [ts-dot-prop] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in ts-dot-prop. It allows an attacker to inject properties on Object.prototype. Module module name: ts-dot-prop version: 1.4.0 npm page: https://www.npmjs.com/package/ts-dot-prop Module Description TypeScript utility to transform nested...

Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

GHSA-M86M-5M44-PC93 Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

PT-2020-21398

Name of the Vulnerable Software and Affected Versions grpc-ts-health-check versions prior to 2.0.0 Description The issue allows attackers to set the service's health status to failing through an exposed API endpoint, leading to Denial of Service as Kubernetes blocks traffic to services with a...

ts-location.fr Cross Site Scripting vulnerability OBB-1237712

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Royal TS Authentication Bypass Vulnerability

Royal TS is a remote management solution from the Royal Apps team. The solution offers secure connection sharing, file synchronization, and more. A security vulnerability exists in versions prior to Royal TS 5. An attacker can exploit this vulnerability with the help of brute force method to bypa...

CVE-2020-13872

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

CVE-2020-13872

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

Authentication flaw

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

CVE-2020-13872

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

CVE-2020-13872

CVE-2020-13872 affects Royal TS before version 5. The root issue is a 0.0.0.0 listener that enables attackers to bypass tunnel authentication via brute-force. Documented impact aligns with bypass of authentication for SSH tunnels, with CVSS3.1 indicating high impact on confidentiality, integrity,...

CVE-2020-13872: Improper Restriction of Excessive Authentication Attempts

Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach...

CVE-2017-18692

An issue was discovered on Samsung mobile devices with M6.0 and N7.0 MSM8939, MSM8996, MSM8998, Exynos7580, Exynos8890, or Exynos8895 chipsets software. There is a race condition, with a resultant buffer overflow, in the sects touchscreen sysfs interface. The Samsung ID is SVE-2016-7501 January...

PT-2020-8241

Name of the Vulnerable Software and Affected Versions: Samsung mobile devices with M6.0 and N7.0 software Description: An issue was discovered in the sec ts touchscreen sysfs interface, where a race condition leads to a buffer overflow. This issue affects Samsung mobile devices with M6.0 and N7.0...

CVE-2020-8146

In UniFi Video v3.10.1 for Windows 7/8/10 x64 there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the...