Ubiquiti Inc.: RCE in AirOS 6.2.0 Devices with CSRF bypass

There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution. These vulnerabilities can be also can be also paired with other e...

FANUC 18-MB Control System

Binary data 764771.prm...

CVE-2019-13991

Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs directly connected to GPIO pins via a laser, because of LED photosensitivity...

CVE-2018-12204

Improper memory initialization in Platform Sample/Silicon Reference firmware IntelR Server Board, IntelR Server System and IntelR Compute Module may allow privileged user to potentially enable an escalation of privilege via local access...

Rockstar Games: CSRF Vulnerability on post creation page /community/create-post.json

In this report the researcher demonstrated how to exploit a CSRF vulnerability on the impacted endpoint. This would allow a remote attacker to spam the community boards as other users. This attack only worked in Chrome browsers. A recent update to Chrome changed how cross-origin requests are...

Design/Logic Flaw

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applications. The Resident Download Manager does not verify that the firmware is authentic before executi...

CVE-2016-6567 SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devices

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applications. The Resident Download Manager does not verify that the firmware is authentic before executi...

Code injection

BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes to the SMBUS...

Further Down the Trello Rabbit Hole

Last month's story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support...

Gitlab Projects::BoardsController component authorization bypass vulnerability

GitLab is a set of open source applications developed using Ruby on Rails , you can implement a self-hosted Git version control system project repository , it has similar features to Github , you can access the project's file content , commit history , bug lists , etc. Gitlab Enterprise Edition E...

[SECURITY] Fedora 27 Update: cyrus-imapd-3.0.4-1.fc27

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

SQL Injection Vulnerability in SDCMS v1.1 Frontend Message Boards

SDCMS is a PHP 3-in-1 website management system independently developed by Fireworks Network. SDCMS v1.1 version of the foreground message board there are SQL injection vulnerabilities, attackers can use the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in OURPHP Message Boards

OURPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. A SQL injection vulnerability exists in the OURPHP V1.7.3 message board, which is caused by the system failing to strictly filter the parameters entered by the user. ...

choons.at XSS vulnerability

Vulnerable URL: https://choons.at/boards/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 814023 VIP website status:| No Check choons.at SSL connection:| Grade: A+ Coordinated...

Stored Cross-site Scripting Vulnerability at YXcmsApp Message Boards

Yxcms is an enterprise building system based on PHP and mysql technology. A stored cross-site scripting vulnerability exists at the YXcmsApp message board. The vulnerability allows an attacker to construct cross-site statements, perform pop-up box operations, and also obtain sensitive information...

boards.ancestry.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-203248 Description| Value ---|--- Affected Website:| boards.ancestry.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

boards.ancestry.com XSS vulnerability

Open Bug Bounty ID: OBB-203249 Description| Value ---|--- Affected Website:| boards.ancestry.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Trello: If a team is public, the web socket receives data about the Team visible boards

When viewing a public team, users are allowed to connect to an update channel that notifies them of changes made to the team. When a "team visible" not public board was added or removed from a public team, an update with the name of the team would be sent to all subscribers, potentially including...

2016 Cybersecurity Predictions

The lessons learned from this past year teach us that no one is immune to cyber threats. The sooner corporate boards and executives come to understand that cybersecurity breaches are a very real and pervasive threat; then the hard work can begin to take preemptive measures and prepare an...

Unspecified vulnerability in Boosted Boards skateboards

Boosted Boards Skateboards is a popular piece of motorized equipment. Boosted Boards Skateboards has a security vulnerability that allows an attacker with physical access to the device to modify the skateboarding motion by hijacking the Bluetooth signal to physically injure a person...