rubygems: Unsafe object deserialization through YAML formatted gem specifications

A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter...

yithemes.com XSS vulnerability

Open Bug Bounty ID: OBB-555929 Description| Value ---|--- Affected Website:| yithemes.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based ...

tr.wikiloc.com XSS vulnerability

Open Bug Bounty ID: OBB-533694 Description| Value ---|--- Affected Website:| tr.wikiloc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AZL-45099 CVE-2015-9251 affecting package python-blinker for versions less than 1.7.0-4

jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-16689

A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting...

Pelco Sarix Pro Network Camera set_param Program Has an Override Access Vulnerability

pelco Sarix Professional is a video camera. An override access vulnerability exists in the pelco Sarix Pro network camera setparam program. The vulnerability allows attackers to remotely enable ssh services without authentication to take full control of the camera...

108ham.com XSS vulnerability

Open Bug Bounty ID: OBB-391001 Description| Value ---|--- Affected Website:| 108ham.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

ja.de XSS vulnerability

Open Bug Bounty ID: OBB-361127 Description| Value ---|--- Affected Website:| ja.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

JanTek JTC-200 Unauthorized Access Vulnerability

JanTek JTC-200 is a TCP/IP converter serial server from Taito JanTek Technology. An unauthorized access vulnerability exists in the JanTek JTC-200. An attacker can access the Busybox Linux shell via Telnet service without any authentication...

hermeslight.it Open Redirect vulnerability

Vulnerable URL: http://www.hermeslight.it/flashdetection.swf?flashContentURL=https://openbugbounty.org Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 07.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank...

nesterovsky-bros.com Open Redirect vulnerability

Vulnerable URL: http://www.nesterovsky-bros.com/weblog/ct.ashx?id=982af0b6-9789-4368-b75f-29c832f2a0ec=data%3Atext%2Fhtml%3Bbase64%2CPHNjcmlwdD5hbGVydCgvT1BFTkJVR0JPVU5UWS8pPC9zY3JpcHQ%2B Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 01.01.2018...

ALPINE-CVE-2017-6362

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors...

Moxa SoftCMS Live Viewer SQL Injection Vulnerability

Moxa SoftCMS Live Viewer is a video surveillance software designed for industrial automation systems. A SQL injection vulnerability exists in Moxa SoftCMS Live Viewer 1.6 and earlier versions, which can be exploited by an attacker to access SoftCMS without knowing the user's password...

kernel: crypto: GPF in lrw_crypt caused by null-deref

The lrwcrypt function in 'crypto/lrw.c' in the Linux kernel before 4.5 allows local users to cause a system crash and a denial of service by the NULL pointer dereference via accept2 system call for AFALG socket without calling setkey first to set a cipher key...

conservationevidence.com XSS vulnerability

Vulnerable URL:...

kernel: crypto: GPF in lrw_crypt caused by null-deref

The lrwcrypt function in 'crypto/lrw.c' in the Linux kernel before 4.5 allows local users to cause a system crash and a denial of service by the NULL pointer dereference via accept2 system call for AFALG socket without calling setkey first to set a cipher key...

tcpdump: multiple overflow issues in protocol decoding

Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker could create a crafted pcap file or send specially crafted packets to the network segment where tcpdump is running in live capture mode without -w which...

Fusion K2 wireless router suffers from an override access vulnerability

The Fusion K2 PSG1218 router is a new generation of wireless routers for entry-level users. The Fusion K2 wireless router is vulnerable to an override access vulnerability. An attacker can use the vulnerability to obtain the details of all end devices in the LAN without logging in, and also perfo...

CVE-2017-10601

A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically...