instamaker.co.kr Cross Site Scripting vulnerability OBB-2487539

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts

A server-side request forgery SSRF flaw in an API of a large financial technology fintech platform potentially could have compromised millions of bank customers, allowing attackers to defraud clients by controlling their bank accounts and funds, researchers have found. A team at Salt Security’s...

Backdoor.Win32.Jokerdoor Hardcoded Credential

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/a6437375fff871dff97dc91c8fd6259f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Jokerdoor Vulnerability: Weak Hardcoded Credentials Family: Jokerdoor Type: PE32 MD5:...

Spring Cloud Function SpEL Injection Exploit

Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attack...

EUVD-2022-30832

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...

GSD-2022-1000939 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.305 by commit...

GSD-2022-1000903 usb: gadget: clear related members when goto fail

usb: gadget: clear related members when goto fail This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.233 by commit...

GSD-2022-1000873 net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()

net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.183 by commit...

GSD-2022-1000810 gso: do not skip outer ip header in case of ipip and net_failover

gso: do not skip outer ip header in case of ipip and netfailover This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.26 by commit...

GSD-2022-1000798 iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot

iio: imu: stlsm6dsx: wait for settling time in stlsm6dsxreadoneshot This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.26 by commit...

GSD-2022-1000794 RDMA/cma: Do not change route.addr.src_addr outside state checks

RDMA/cma: Do not change route.addr.srcaddr outside state checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.26 by commit...

GSD-2022-1000749 ice: fix concurrent reset and removal of VFs

ice: fix concurrent reset and removal of VFs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.12 by commit...

GSD-2022-1000735 configfs: fix a race in configfs_{,un}register_subsystem()

configfs: fix a race in configfs,unregistersubsystem This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.12 by commit...

GSD-2022-1000718 tipc: fix a bit overflow in tipc_crypto_key_rcv()

tipc: fix a bit overflow in tipccryptokeyrcv This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...

Exploit for Cross-Site Request Forgery (CSRF) in Irz Ru21_Firmware

ez-iRZ Exploit for CVE-2022-27226 Cross Site Request Forgery...

GSD-2022-1000561 mtd: parsers: qcom: Fix missing free for pparts in cleanup

mtd: parsers: qcom: Fix missing free for pparts in cleanup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

GSD-2022-1000545 vsock: remove vsock from connected table when connect is interrupted by a signal

vsock: remove vsock from connected table when connect is interrupted by a signal This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by...

GSD-2022-1000534 parisc: Fix data TLB miss in sba_unmap_sg

parisc: Fix data TLB miss in sbaunmapsg This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

GSD-2022-1000498 riscv: eliminate unreliable __builtin_frame_address(1)

riscv: eliminate unreliable builtinframeaddress1 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.10 by commit...

GSD-2022-1000302 net: do not keep the dst cache when uncloning an skb dst and its metadata

net: do not keep the dst cache when uncloning an skb dst and its metadata This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.267 by commit...