EE 4GEE WiFi MBB Cross-Site Scripting Vulnerability

The EE 4GEE WiFi MBB is a mobile wireless router device from EE UK. A cross-site scripting vulnerability exists in versions prior to EE 4GEE WiFi MBB EE600005.0031, which stems from a lack of input validation or encryption in the program. A remote attacker can exploit the vulnerability to inject...

CVE-2017-14269

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

CVE-2017-14267

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

Cross site request forgery (csrf)

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14267

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14267

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14267

EE 4GEE WiFi MBB devices (before EE60_00_05.00_31) are affected by a Cross‑Site Request Forgery (CSRF) vulnerability in admin actions exposed via goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings. The issue enables un...

CVE-2017-14268

CVE-2017-14268 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). A Cross-Site Scripting (XSS) vulnerability exists in the sms_content parameter of a getSMSlist request. Exploitation context and impact are limited in the provided documents to input‑based script injection; no further expl...

CVE-2017-14269

CVE-2017-14269 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). The vulnerability allows remote attackers to obtain sensitive data via a JSONP endpoint, demonstrated as passwords and SMS content exposure. The root cause is an insecure JSONP/endpoint handling that leaks confidential inf...

CVE-2017-14269: Exposure of Sensitive Information to an Unauthorized Actor

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

CVE-2017-14268: Improper Neutralization of Input During Web Page Generation

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14267: Cross-Site Request Forgery (CSRF)

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

PT-2017-13336

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue allows remote attackers to obtain sensitive information via a JSONP endpoint. This can include passwords and SMS content. Recommendations For versions before EE60 00 05.00...

PT-2017-13335

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue concerns an XSS vulnerability in the sms content parameter of a "getSMSlist" request. Recommendations For versions before EE60 00 05.00 31, update to version EE60 00 05.00...

PT-2017-13334

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue is related to Cross-Site Request Forgery CSRF and is associated with several API endpoints, including "goform/AddNewProfile", "goform/setWanDisconnect",...

EE 4GEE Wireless Router EE60_00_05.00_25 XSS / CSRF / Disclosure

EE 4GEE Wireless Router - Multiple Security Vulnerabilities Advisory ------------------------------------------------- Hardware Version/Model: 4GEE WiFi MBB EE60VB-2AE8G83. Vulnerable Software Version: EE600005.0025. Patched Software Version: EE600005.0031. Product URL:...

Apache Struts REST plugin XStream deserialization vulnerability

Added: 09/08/2017 CVE: CVE-2017-9805 BID: 100609 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem The REST plugi...

CVE-2017-12426

CVE-2017-12426 affects GitLab CE/EE: versions before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4, may allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import. CVSSv3 base score 8.8 (HIGH); CV...