EUVD-2017-5770

Malware in sbrugna...

EUVD-2017-5772

Malware in sbrugna...

Flaw in 4GEE WiFi Modem Could Leave Your Computer Vulnerable

A high-severity vulnerability has been discovered in 4G-based wireless 4GEE Mini modem sold by mobile operator EE that could allow an attacker to run a malicious program on a targeted computer with the highest level of privileges in the system. The vulnerability—discovered by 20-year-old Osanda...

Cross site request forgery (csrf)

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14267

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

Cross site request forgery (csrf)

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14268

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14269

CVE-2017-14269 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). The vulnerability allows remote attackers to obtain sensitive data via a JSONP endpoint, demonstrated as passwords and SMS content exposure. The root cause is an insecure JSONP/endpoint handling that leaks confidential inf...

CVE-2017-14269: Exposure of Sensitive Information to an Unauthorized Actor

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

CVE-2017-14268: Improper Neutralization of Input During Web Page Generation

EE 4GEE WiFi MBB before EE600005.0031 devices have XSS in the smscontent parameter in a getSMSlist request...

CVE-2017-14267: Cross-Site Request Forgery (CSRF)

EE 4GEE WiFi MBB before EE600005.0031 devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings...

PT-2017-13336

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue allows remote attackers to obtain sensitive information via a JSONP endpoint. This can include passwords and SMS content. Recommendations For versions before EE60 00 05.00...

PT-2017-13335

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue concerns an XSS vulnerability in the sms content parameter of a "getSMSlist" request. Recommendations For versions before EE60 00 05.00 31, update to version EE60 00 05.00...

PT-2017-13334

Name of the Vulnerable Software and Affected Versions EE 4GEE WiFi MBB versions before EE60 00 05.00 31 Description The issue is related to Cross-Site Request Forgery CSRF and is associated with several API endpoints, including "goform/AddNewProfile", "goform/setWanDisconnect",...

EE 4GEE Wireless Router EE60_00_05.00_25 XSS / CSRF / Disclosure Vulnerabilities

EE 4GEE wireless router version EE600005.0025 suffers from cross site request forgery, cross site scripting, and information disclosure vulnerabilities. EE 4GEE Wireless Router - Multiple Security Vulnerabilities Advisory ------------------------------------------------- Hardware Version/Model:...