WordPress WPS Cleaner plugin <= 1.4.4 - Cross-Site Request Forgery (CSRF) + media disclosure vulnerabilities

Cross-Site Request Forgery CSRF + media disclosure vulnerabilities found by Julio Potier in WordPress WPS Cleaner plugin versions = 1.4.4. Solution Update the WordPress WPS Cleaner plugin...

WPS Cleaner <= 1.4.4 - Multiple Issues

CSRF, Media Dislcosure...

Jisiwei i3 robot vacuum cleaner encryption issue vulnerability

Jisiwei i3 is a vacuuming robot from the Chinese company Jisiwei. A vulnerability with encryption issues exists in version 2.0 of the Jisiwei i3 robot vacuum cleaner APP. The vulnerability stems from a networked system or product that does not properly utilize relevant cryptographic algorithms,...

CVE-2019-12820

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account,...

CVE-2019-12821

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code...

Design/Logic Flaw

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account,...

Code injection

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code...

CVE-2019-12821

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code...

CVE-2019-12821

The CVE concerns the Shenzhen Jisiwei i3 robot vacuum cleaner’s app 2.0. A QR code used to add a device to an account encodes the device ID using a predictable pattern (JSW + six digits). An attacker can generate a QR-code with a target device ID to connect an arbitrary device and gain full acces...

CVE-2019-12820

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account,...

CVE-2019-12820

The CVE-2019-12820 entry concerns the Shenzhen Jisiwei i3 robot vacuum cleaner app 2.0 (Android/iOS). The vulnerability is that login and other personal information communications between the app and its server are sent over unencrypted HTTP, enabling a local-network MiTM attacker to capture cred...

River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) Exploit

Exploit Title: River Past Video Cleaner Buffer Overflow SEH Exploit Author: crashmanucoot Contact: twitter.com/crashmanucoot Software Link: https://river-past-video-cleaner.softonic.com/ Version: 7.6.3 Tested on: Windows 10 Pro x64 SPANISH Category: Windows Local Exploit How to use:open the progr...

River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH)

River Past Video Cleaner 7.6.3 - Local Buffer Overflow SEH Exploit Title: River Past Video Cleaner Buffer Overflow SEH Date: 9-2-2019 Exploit Author: crashmanucoot Contact: twitter.com/crashmanucoot Software Link: https://river-past-video-cleaner.softonic.com/ Version: 7.6.3 Tested on: Windows 10...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

Netgate Registry Clenaner Local Elevation of Privilege Vulnerability

NETGATE Registry Cleaner is a disk cleaner. A local elevation of privilege vulnerability exists in Netgate Registry Clenaner, which can be exploited by an attacker to elevate privileges...

CVE-2017-13108

CVE-2017-13108 : DFNDR Security Antivirus, Anti-hacking & Cleaner (Android, version 5.0.9, 2017-11-01) uses a hard-coded encryption key. Data encrypted with this key can be decrypted by anyone who obtains the key, exposing potentially sensitive user data. The connected documents confirm this Andr...

DisplayLink Core Software Cleaner Application Elevation of Privilege Vulnerability

DisplayLink Core Software Cleaner Application is a dedicated removal tool for uninstalling DisplayLink software. A security vulnerability exists in DisplayLink Core Software Cleaner Application 8.2.1956. The vulnerability can be exploited to hijack a DLL and elevate its privileges to SYSTE by...

CVE-2018-7884

An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL...

CVE-2018-7884

DisplayLink Core Software Cleaner Application 8.2.1956 has a privilege-elevation issue when drivers are updated: cl_1956.exe runs as SYSTEM in the systemroot\Temp folder, where a user can place a DLL (for example version.dll) to enable DLL hijacking and escalate to SYSTEM. This is a local vulnera...

SUSE SLED12 / SLES12 Security Update : libmodplug (SUSE-SU-2018:1441-1)

This update for libmodplug fixes the following issues : - Update to version 0.8.9.0+git20170610.f6dd59a bsc1022032 : - PSM: add missing line to commit - ABC: prevent possible increment of p past end - ABC: ensure read pointer is valid before incrementing - ABC: terminate early when things don't...