CVE-2019-1010200: Improper Neutralization of Special Elements used in an OS Command

Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'. The impact is: Remote code execution with the same privileges as th...

GSA Bounty: Redirect on authorization allows account compromise

Login.gov had a bug in validating the redirecturi in the /openidconnect/authorize endpoint, which allowed specially crafted subdomains to be incorrectly validated when they began with a valid hostname. For example, a redirecturi with a hostname of agency.gov.example.com would validate a URL as if...

GSA Bounty: Subdomain Takeover

@picklepwns discovered a subdomain takeover attack. Technically, the domain was out of scope for our Vulnerability Disclosure Policy. We want to remind hackers to please limit their testing to domains explicitly listed in that scope which is repeated on our HackerOne program page for convenience...

GSA Bounty: CSRF to change Account Security Keys on secure.login.gov

This may not be in scope and nor be eligible for bounty but I read this in your vulnerability disclosure policy: While not all of our services are in scope for our Bug Bounty program, we do welcome disclosures of vulnerabilities through our Vulnerability Disclosure Policy. We would encourage you ...

TTS Test App - SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application TTS Test App published at the 'play' market has multiple vulnerabilities...

eSpeak TTS - ContentProvider mode not defined, Dangerous filesystem permissions, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application eSpeak TTS published at the 'play' market has multiple vulnerabilities...

FBReader TTS+ Plugin - Exported components, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application FBReader TTS+ Plugin published at the 'play' market has multiple vulnerabilities...

chromium-browser: use-after-free in Speech

Use-after-free vulnerability in browser/speech/ttsmessagefilter.cc in the Speech implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab...

[SECURITY] Fedora 20 Update: speech-dispatcher-0.8-9.fc20

Common interface to different TTS engines Handling concurrent synthesis requests =E2=80=93 requests may come asynchronously from multiple sources within an application and/or from more different applications. Subsequent serialization, resolution of conflicts and priorities of incoming requests...

Cross site scripting

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

Default credentials

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...

Sql injection

Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-0689

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

CVE-2006-0689

CVE-2006-0689 affects TTS Software’s Time Tracking Software (Version 3.0). The vulnerability is a Cross-site Scripting (XSS) flaw in the Registration Form: the UserName parameter is not properly sanitized, allowing remote attackers to inject arbitrary script/HTML. Public disclosures in NVD and re...

CVE-2006-0691

CVE-2006-0691 concerns TTS Time Tracking Software 3.0. The vulnerability lies in edituser.php, which does not verify that the provided name and password are correct, enabling remote attackers to overwrite arbitrary data belonging to any account. Affected component: edituser.php in Time Tracking S...

CVE-2006-0689

Cross-site scripting XSS vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter...

CVE-2006-0690

Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-0691

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...

CVE-2006-0690

CVE-2006-0690 affects TTS Time Tracking Software 3.0 with multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Public sources (NVD/eVuln) cite remote exploitation and, per eVuln, unauthorized data modification and additional...

CVE-2006-0691: Undefined Security Weakness

edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account...