CVE-2018-19394

CVE-2018-19394 concerns Cobham Satcom Sailor 800 and Sailor 900 devices, where a persistent cross-site scripting (XSS) vulnerability exists. The affected component is the device web interface/configuration handling, with the root cause described as an XSS payload that can be introduced by modifyi...

CVE-2018-19391

The CVE-2018-19391 entry concerns Cobham Satcom Sailor 250 and Sailor 500 devices with persistent cross-site scripting (XSS) in firmware before 1.25. An unauthenticated attacker can exploit this via the /index.lua?pageID=Phone%20book name field to inject JavaScript. Connected CNVD/NVD records con...

CVE-2018-19394

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

CVE-2018-19393

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could b...

CVE-2018-19391

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field...

CVE-2018-19392

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

CVE-2018-19392

Cobham Satcom Sailor 250/500 devices before firmware 1.25 have an unauthenticated password-reset vulnerability that lets a remote attacker change any user password (including admin) using the username and the attack vector /index.lua?pageID=Administration with fields usernameAdmChange, passwordAd...

Cobham Sea Tel Information Disclosure Vulnerability (CNVD-2018-03967)

Cobham Sea Tel is a suite of wireless communication terminals from Cobham UK. An information disclosure vulnerability exists in Cobham Sea Tel version 121 build 222701. A remote attacker can exploit this vulnerability by sending a /cgi-bin/getSysStatus request to obtain sensitive information...

CVE-2018-5728

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details...

Cross site request forgery (csrf)

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details...

CVE-2018-5728

CVE-2018-5728 concerns Cobham Sea Tel 121 build 222701 devices. A remote attacker can disclose potentially sensitive information by sending a request to /cgi-bin/getSysStatus, exposing ship latitude/longitude and satellite details. The vulnerability is described as an information disclosure issue...

CVE-2018-5728

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details...

Cobham Sea Tel Security Bypass Vulnerability

Cobham Sea Tel is a suite of wireless communication terminals from Cobham UK. A security bypass vulnerability exists in Cobham Sea Tel version 121 build 222701. A remote attacker can bypass authentication by sending a direct request to the MenuDealerGx.html, MenuDealer.html, MenuEuNCGx.html,...

Cobham Sea Tel Web Server Cross-Site Scripting Vulnerability

Cobham Sea Tel is a suite of wireless communication terminals from Cobham UK. A cross-site scripting vulnerability exists in the web server in Cobham Sea Tel version 116 build 222429. The vulnerability can be exploited by a remote attacker to inject malicious JavaScript code via the device's TELN...

Cobham Sea Tel Information Disclosure Vulnerability

Cobham Sea Tel is a suite of wireless communication terminals from Cobham UK. An information disclosure vulnerability exists in Cobham Sea Tel version 121 build 222701. An attacker can exploit this vulnerability by reading the loginName line in the js/userLogin.js URI to obtain sensitive...

CVE-2018-5266

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...

CVE-2018-5071

Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross...

Default credentials

Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...

Cross site scripting

Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross...

CVE-2018-5267

Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html, MenuDealer.html, MenuEuNCGx.html, MenuEuNC.html, MenuSysGx.html, or MenuSys.html...