CVE-2017-12577

An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password "admin:password" is used in the Android application that allows attackers to use a hidden API URL "/goform/SystemCommand" to execute any command with root permission...

CVE-2017-12573

PLANEX CS-W50HD devices with firmware prior to 030720 expose a command-injection vulnerability in the web management UI on the NAS settings page at /cgi-bin/nasset.cgi. An attacker can send a crafted HTTP POST request to execute arbitrary code, with authentication required before the attack. This...

PT-2018-5427

Name of the Vulnerable Software and Affected Versions: PLANEX CS-W50HD devices with firmware before 030720 Description: A command-injection issue exists in the web management UI on the NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to execute arbitrary...

PT-2018-5430

Name of the Vulnerable Software and Affected Versions: PLANEX CS-QR20 version 1.30 Description: A hidden and undocumented management page in the device allows an attacker to execute arbitrary code when the user is authenticated. The management page, used for debugging purposes and accessible at t...

CVE-2017-12573: Undefined Security Weakness

An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vulnerability in the web management UI on NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to execute arbitrary code. Authentication is...

CVE-2017-12577: Use of Hard-coded Credentials

An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password "admin:password" is used in the Android application that allows attackers to use a hidden API URL "/goform/SystemCommand" to execute any command with root permission...

CVE-2017-12576: Exposure of Resource to Wrong Sphere

An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. The management page was used for debugging purposes, once you login and access the page directly...

CVE-2017-12574: Use of Hard-coded Credentials

An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authentication database "/.htpasswd" during booting process, which allows attackers to gain unauthorized access and control the device completely; th...

PT-2018-5428

Name of the Vulnerable Software and Affected Versions: PLANEX CS-W50HD devices with firmware prior to 030720 Description: A hardcoded credential supervisor:dangerous is injected into the web authentication database /.htpasswd during the booting process, allowing attackers to gain unauthorized...

PT-2018-5431

Name of the Vulnerable Software and Affected Versions: PLANEX CS-QR20 version 1.30 Description: A security issue was found where a hardcoded account and password, admin and password, are used in the Android application. This allows attackers to utilize a hidden API URL "/goform/SystemCommand" to...

PLANEX CS-W50HD Hardcoded Credential

Reserved CVE: CVE-2017-12574 Description A hidden and undocumented account exists that allows attackers to gain unauthorized access and control the device completely; the account can't be modified or deleted. Vulnerability Type Default user/password Affected Product Code Base Firmware ver 030608...

PLANEX CS-QR20 Command Execution

Reserved CVE: CVE-2017-12576 Description A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. Vulnerability Type Insecure Permissions Affected Product Code Base Firmware ver 1.30 Affected Component Web management UI...

PLANEX CS-W50HD Command Injection Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. The...

PLANEX CS-QR20 Hardcoded Voucher Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...

PLANEX CS-QR20 Arbitrary Code Execution Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...

PLANEX CS-W50HD Default Username Password Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...

Unspecified Security Vulnerability in Oracle PeopleSoft Products PeopleSoft Enterprise CS Financial Aid Component

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise CS Financial Aid is one of the financial management components. An...

Thompson Reuters UltraTax CS 2017 for Windows Information Disclosure Vulnerability (CNVD-2019-19056)

Thompson Reuters UltraTax CS 2017 for Windows is a Windows-based automated tax management software from Thompson Reuters, USA. The software is primarily used to automate the management of business or personal tax workflows. An information disclosure vulnerability exists in Thompson Reuters UltraT...

munishop.muni.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-654410 Description| Value ---|--- Affected Website:| munishop.muni.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

Code injection

Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleartext over SMBv2, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified...