CVE-2017-17901: Uncontrolled Resource Consumption

ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service CPU consumption via a flood of IP packets with a TTL of 1...

PT-2017-15086

Name of the Vulnerable Software and Affected Versions ZyXEL P-660HW version v3 Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by flooding the device with IP packets that have a TTL of 1. Recommendations For ZyXEL P-660HW version v3,...

CVE-2017-17873

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17873: Improper Neutralization of Special Elements used in an SQL Command

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17911: Improper Neutralization of Input During Web Page Generation

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503...

ZyXEL P-660HW TTL Expiry Denial Of Service

Exploit Title: ZyXEL TTL Expiry Denial of Service CVE: CVE-2017-17901 CWE: CWE-400 Exploit Author: Hosein Askari Vendor HomePage: https://www.zyxel.com/ Version : v3 Tested on: ZyXEL P-660HW Category: Network Appliance Author Mail : [email protected] description: According to RFC 791, the...

PT-2017-15062

Name of the Vulnerable Software and Affected Versions Vanguard Marketplace Digital Products PHP version 1.4 Description The issue is related to SQL Injection, which occurs via the PATH INFO to the /p URI. Recommendations For version 1.4, update to a newer version that contains a fix for this issu...

PT-2017-5039

Name of the Vulnerable Software and Affected Versions: bSuite plugin versions prior to 5 alpha 3 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the s or p parameters to...

CVE-2011-4955: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in uistats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s or 2 p parameters to index.php...

CVE-2017-17107

Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session...

CVE-2017-17106

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

Hardcoded credentials

Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session...

Command injection

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

Design/Logic Flaw

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

CVE-2017-17107: Use of Hard-coded Credentials

Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session...

CVE-2017-17105

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

CVE-2017-17106: Insufficiently Protected Credentials

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages...

CVE-2017-17105: Improper Neutralization of Special Elements used in an OS Command

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

CVE-2017-17106

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages. Recent assessments...

CVE-2017-17105

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...