CVE-2017-16563: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the Basic Settings screen on Vonage Grandstream HT802 devices allows attackers to modify settings, related to cgi-bin/update...

CVE-2017-16565: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in /cgi-bin/login on Vonage Grandstream HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests...

PT-2017-14450

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the /cgi-bin/login API endpoint. This allows attackers to authenticate a user via the login screen using the...

MitraStar GPT-2541GNAC (HGU) and DSL-100HN-T1 Elevation of Privilege Vulnerability

The MitraStar GPT-2541GNAC HGU and DSL-100HN-T1 are both MitraStar router products. An elevation of privilege vulnerability exists in the MitraStar GPT-2541GNAC HGU version 1.00VNJ0b1 and DSL-100HN-T1 ES113WJY0b16. An attacker can exploit this vulnerability to gain root access by specifying /bin/...

PT-2017-14448

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description The issue concerns a Cross-Site Request Forgery CSRF in the Basic Settings screen. This allows attackers to modify settings related to the cgi-bin/update endpoint...

CVE-2017-16564: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in /cgi-bin/config2 on Vonage Grandstream HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field P148...

PT-2017-14449

Name of the Vulnerable Software and Affected Versions Vonage Grandstream HT802 devices affected versions not specified Description A stored Cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field,...

CVE-2017-16522: Incorrect Default Permissions

MitraStar GPT-2541GNAC HGU 1.00VNJ0b1 and DSL-100HN-T1 ES113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute...

Debian DLA-1158-1 : bchunk security update

Several vulnerabilities were discovered in bchunk, a tool to convert a CD image in .bin/.cue format into a set of .iso and .cdr/.wav tracks. It was possible to trigger a heap-based buffer overflow with an resultant invalid free when processing a malformed CUE .cue file that may lead to the...

Unspecified vulnerability in radare

radare is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'stringscanrange' function in the libr/bin/bin.c file in radare version 2.0.1. No details of the vulnerability are provided at this time...

Out-of-bounds

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

Memory corruption

In radare 2.0.1, a memory corruption vulnerability exists in storeversioninfognuverdef and storeversioninfognuverneed in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper shsize validation when allocating memory...

UBUNTU-CVE-2017-16358

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

PT-2017-14371

Name of the Vulnerable Software and Affected Versions radare2 version 2.0.1 Description An out-of-bounds read issue exists in the string scan range function in libr/bin/bin.c when performing a string search. Recommendations For radare2 version 2.0.1, at the moment, there is no information about a...

CVE-2017-16358: Out-of-bounds Read

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

PT-2017-3370

Name of the Vulnerable Software and Affected Versions MitraStar GPT-2541GNAC HGU version 1.00VNJ0b1 DSL-100HN-T1 version ES 113WJY0b16 Description The issue is related to inadequate access control in the firmware of the affected devices. It allows remote authenticated users to gain root access by...

Directory traversal

Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files...

CVE-2017-15805

Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files...

CVE-2017-15805

Cisco Small Business SA520/SA540 devices with firmware 2.1.71 and 2.2.0.7 are affected by a directory traversal vulnerability in scgi-bin/platform.cgi via the thispage parameter, enabling reading of arbitrary files. Root cause: improper validation of the thispage parameter leading to path travers...

PT-2017-14236

Name of the Vulnerable Software and Affected Versions Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 Description The issue allows for directory traversal in "scgi-bin/platform.cgi" via the thispage parameter, enabling the reading of arbitrary files. Recommendations...