CVE-2023-41898 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

CVE-2023-44385

CVE-2023-44385 : Affects Home Assistant Companion for iOS and macOS up to version 2023.4. The vulnerability is a Client-Side Request Forgery that allows an attacker to lure a victim into visiting a malicious link or QR code, causing the victim to invoke arbitrary services on their Home Assistant ...

CVE-2023-44385 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this...

Home Assistant Data Falsification Issue Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from Home assistant not setting the HTTP security header. An attacker can...

Home Assistant Security Breach

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security flaw in the component webhook that allows an attacker to...

Home Assistant Information Disclosure Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. An information disclosure vulnerability exists in Home Assistant versions prior to 2023.9.0, which stems from a vulnerability that allows an attacker to log in and...

PT-2023-28151 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The Home Assistant login page is affected by a Cross-site Scripting XSS issue. This occurs because the redirect uri validation does not properly check the scheme of URLs, allowing for...

Home Assistant Cross-Site Scripting Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security hole in the login page. The vulnerability can be exploited...

Home Assistant Code Injection Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant versions prior to 2023.9.2 that stems from an arbitrary URL loading issue in WebView. An attacker can exploit the...

CVE-2023-41893: Exposure of Sensitive Information to an Unauthorized Actor

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41895: Improper Neutralization of Input During Web Page Generation

Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the redirecturi and clientid parameters. Although the redirecturi validation typically ensures that it matches th...

CVE-2023-41898: Insufficient Verification of Data Authenticity

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential...

PT-2023-28150 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The issue affects Home Assistant, an open-source home automation system. Webhooks in the webhook component can be triggered via the .ui.nabu.casa URL without authentication, even when...

Home Assistant Companion Cross-Site Request Forgery Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7 that stems from the presence of a client request forgery vulnerability. An...

PT-2023-28153

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2023.9.0 Description The issue concerns the omission of HTTP security headers, including the X-Frame-Options header, in Home Assistant server. This omission facilitates covert clickjacking attacks and other...

Home Assistant Code Issue Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Companion versions prior to 2023.7, which stems from a Server Request Forgery SSRF vulnerability in the component...

PT-2023-29219 · Home Assistant · Home Assistant Companion

Name of the Vulnerable Software and Affected Versions: Home Assistant Companion for iOS and macOS versions up to 2023.4 Description: The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can...

CVE-2023-41897: Improper Restriction of Rendered UI Layers or Frames

Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks...