Improper access control

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://target/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 Confidentiality, Integrity...

CVE-2019-11061

CVE-2019-11061 concerns the ASUS HG100 SmartHome Gateway. A broken access control flaw in HG100 firmware versions up to 4.00.06 lets an attacker on the same LAN access http://[target]/smarthome/devicecontrol without authentication, enabling remote control of connected IoT devices. Publicly stated...

CVE-2019-11061 HG100 has a broken access control vulnerability in its Web API Server

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://target/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 Confidentiality, Integrity...

DHS Warns Small Airplanes Vulnerable to Flight Data Manipulation Attacks

What could be more horrifying than knowing that a hacker can trick the plane's electronic systems into displaying false flight data to the pilot, which could eventually result in loss of control? Of course, the attacker would never wish to be on the same flight, so in this article, we are going t...

The vulnerability in the implementation of the ems_usb_disconnect handler in the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the emsusbdisconnect handler in the Astra Linux operating system’s kernel is related to a memory release error. In the emsusbprobe function, located in the drivers/net/can/usb/emsusb.c file, memory is allocated to the txmsgbuffer field. However, the emsusbdisconnect handler...

June 26, 2019—KB4509478 (OS Build 17134.860)

None None...

June 26, 2019—KB4509479 (OS Build 17763.593)

None None...

June 26, 2019—KB4509476 (OS Build 15063.1898)

None None...

The vulnerability of the command-line interface of the programmatically defined Cisco SD-WAN network, related to authentication errors, allows a malicious actor to elevate their privileges to the root level.

The vulnerability of the command-line interface of the programmatically defined Cisco SD-WAN network is related to authentication errors. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

June 26, 2019—KB4509477 (OS Build 16299.1239)

None None...

CVE-2019-1626

A vulnerability in the vManage web-based UI Web UI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected vManage device. The vulnerability is due to a failure to properly authorize certain user actions in the device configuration. An...

WLAN Input Validation Error Vulnerability in Multiple Qualcomm Products

Qualcomm MDM9206 and others are products of Qualcomm Incorporated.MDM9206 is a central processing unit CPU product.MDM9607 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product.WLAN is one of the wireless LAN components. An input validation error vulnerability...

June 11, 2019—KB4503284 (OS Build 16299.1217)

None None...

UBUNTU-CVE-2019-3701

An issue was discovered in cancangwrcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the candlc field. The privileged user "root" with CAPNETADMIN can create a CAN frame modification rule that mak...

Citrix SD-WAN and NetScaler SD-WAN Directory Traversal Vulnerability

SD-WAN, or wide-area software-defined network. A directory traversal vulnerability exists in Citrix SD-WAN and NetScaler SD-WAN, allowing an unauthenticated attacker to access the management interface to compromise hosts...

Citrix SD-WAN and NetScaler SD-WAN SQL Injection Vulnerabilities

Citrix SD-WAN and NetScaler SD-WAN are both software-defined WAN solutions from Citrix Systems USA. The products support real-time path selection, edge routing, stateful firewalls, end-to-end Qos and WANs. A SQL injection vulnerability exists in Citrix SD-WAN and NetScaler SD-WAN, which can be...

Information disclosure

An attacker with remote access to the SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B web interface can disclose information about the camera including camera hardware, wireless network, and local area network information...

CVE-2018-12673

An attacker with remote access to the SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B web interface can disclose information about the camera including camera hardware, wireless network, and local area network information...

Cisco SD-WAN Certificate Validation Security Bypass Vulnerability

Cisco vEdge 100 Series Routers and others are different series of router products from Cisco. the SD-WAN Solution is a suite of network extension solutions that run on it. A security vulnerability exists in Cisco SD-WAN Solution versions prior to 17.2.8 and prior to 18.3.1, which stems from the...

CVE-2018-15387

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a...