133 matches found
TP-Link Tapo c200 1.1.15 Remote Code Execution
Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution RCE Date: 02/11/2022 Exploit Author: hacefresko Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/ Version: 1.1.15 and below Tested on: 1.1.11, 1.1.14 and 1.1.15 CVE : CVE-2021-4045 Write up of the...
TP-Link Tapo c200 1.1.15 - Remote Code Execution Exploit
Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution RCE Exploit Author: hacefresko Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/ Version: 1.1.15 and below Tested on: 1.1.11, 1.1.14 and 1.1.15 CVE : CVE-2021-4045 Write up of the vulnerability:...
TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution RCE Date: 02/11/2022 Exploit Author: hacefresko Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/ Version: 1.1.15 and below Tested on: 1.1.11, 1.1.14 and 1.1.15 CVE : CVE-2021-4045 Write up of the...
Security Bulletin: Spoofing vulnerability in IBM Business Automation Workflow (CVE-2019-4045)
Summary A Spoofing vulnerability has been found in IBM Business Automation Workflow. Vulnerability Details CVEID: CVE-2019-4045 DESCRIPTION: IBM Business Automation Workflow and IBM Business Process Manager provide embedded document management features. Because of a missing restriction in an API,...
CVE-2021-4045
CVE-2021-4045 affects Tp-Link Tapo C200 IP cameras running firmware 1.1.15 and earlier. The vulnerability arises from a root-running uhttpd binary that does not properly filter/escape input, enabling an unauthenticated remote command execution (RCE) and full device compromise. Public documents co...
CVE-2020-4045
SSB-DB version 20.0.0 has an information disclosure vulnerability. The get method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which ...
CVE-2020-4045
SSB-DB 20.0.0 contains an information-disclosure vulnerability in the get() method that can decrypt any decryptable message and return private data. The issue affects peers with private messages, and exploitation is tied to SSB-OOO (default in SSB-Server), which exposes a wrapper around get() to ...
Ubuntu 16.04 LTS / 18.04 LTS : Thunderbird vulnerabilities (USN-4045-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4045-1 advisory. A type confusion bug was discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, a...
CVE-2019-4045
IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241...
CVE-2019-4045
IBM CVE-2019-4045 affects IBM Business Automation Workflow and IBM Business Process Manager, specifically versions 18.0.0.0–18.0.0.2 (and various BPM CF/iFix ranges). The root cause is a missing restriction in an API that allows a client to spoof the last-modified-by value of a document within th...
CVE-2018-4045
CVE-2018-4045 affects CleanMyMac X 4.04. The vulnerability resides in the securelyRemoveItemAtPath function of the helper protocol, where a user-supplied argument is passed to securelyRemoveFileAtPath without validation. An attacker with local access could exploit this to delete files from the ro...
CVE-2017-4045
CVE-2017-4045 is rejected/not used; this CVE ID does not correspond to an active vulnerability entry.
Debian DSA-4045-1 : vlc - security update
Several vulnerabilities have been found in VLC, the VideoLAN project's media player. Processing malformed media files could lead to denial of service and potentially the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in th...
CVE-2015-4045
The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script...
CVE-2015-4045
The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script...
CVE-2015-4045
The CVE-2015-4045 entry concerns AlienVault OSSIM (asset discovery scanner) with a vulnerable sudoers configuration that permits local privilege escalation via a crafted nmap script prior to 5.0.1. Affected component: sudoers handling in the asset discovery scanner; root cause: crafted nmap scrip...
CVE-2016-4045
Open-Xchange OX App Suite vulnerable to XSS via RSS feed links in versions before 7.8.1-rev11. Malicious script can run in the user’s context, enabling session hijacking or triggering actions via the web interface. Remediation observed in connected sources includes vendor fixes: 7.8.1-rev10 (and ...
CVE-2014-4045
The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when subminexpiry is set to zero, allows remote attackers to cause a denial of service assertion failure and crash via an unsubscribe request when not subscribed to the device...
CVE-2014-4045
The CVE-2014-4045 issue affects Asterisk Open Source 12.x prior to 12.3.1, in the PJSIP channel driver's Publish/Subscribe framework. When sub_min_expiry is zero, an unsubscribe request from a not-subscribed endpoint can trigger an assertion and crash (remote DoS). The documented remediation is t...
Asterisk PJSIP Channel Driver Multiple DoS Vulnerabilities (AST-2014-005 / AST-2014-008)
According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following denial of service vulnerabilities in the PJSIP channel driver : - A flaw exists in the publish / subscribe framework when an attempt to unsubscribe is made when...