Lucene search
+L

147 matches found

Kitploit
Kitploit
added 2026/08/26 12:35 a.m.1 views

CVE-2020-35262

CVE-2020-35262: Digisol DG-HR3400 ルーターにおける格納型XSS 脆弱性の説明 脆弱なエンドポイントにはサーバーサイドの入力検証がなく、悪意のあるスクリプトインジェクションをブロックするクライアントサイドのフィルタリングも欠如していることが確認されています。攻撃者はこの脆弱性を利用して、エンドポイントに悪意のあるスクリプトを注入できます。このスクリプトは、ユーザーが脆弱なエンドポイントを開くたびに実行されます。攻撃者はこの脆弱性を利用して悪意のある操作を行い、デバイスを乗っ取り、最終的にはネットワークを乗っ取ることが可能です。 研究者: Sayli...

6.1CVSS0.00856EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/26 12:35 a.m.1 views

CVE-2020-25498

CVE-2020-25498: Beetel 777VR1 ルーターにおける CSRF 経由の格納型 XSS 脆弱性の説明 脆弱性のあるエンドポイントにはサーバーサイドの入力検証がなく、悪意のあるスクリプトインジェクションに対するクライアントサイドのフィルタリングも欠如していることが確認されています。攻撃者はこの脆弱性を利用して、エンドポイントに悪意のあるスクリプトを注入でき、そのスクリプトはユーザーが脆弱性のあるエンドポイントを開くたびに実行されます。攻撃者は POST リクエストペイロードを含む悪意のある URL を送信し、CSRF を介して管理モジュールで XSS...

4.8CVSS0.01061EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/25 4:14 a.m.2 views

CVE-2020-27199

CVE-2020-27199 Magic Home Pro - 認証バイパス Magic Home Pro Mobile Application(モバイルアプリケーション)に複数の脆弱性が見つかりました。このアプリケーションは、JadeHomic LED Strip RGB Kitと連携するために使用されます。これらの脆弱性の中で最も重大なものは、認証バイパス CVE-2020-27199 の脆弱性であり、最終的には被害者の全デバイスグループを完全に乗っ取り、制御することを可能にします。...

7.5CVSS8.2AI score0.02875EPSS
SaveExploits4References4
The Hacker News
The Hacker News
added 2026/08/20 11:26 a.m.6 views

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...

6.3AI score
SaveExploits0
The Hacker News
The Hacker News
added 2026/08/11 12:05 p.m.23 views

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...

5.9AI score
SaveExploits0
Cvelist
Cvelist
added 2026/06/12 6:13 p.m.54 views

CVE-2026-42947 Naxclow IoT Platform Authorization bypass through User-Controlled key

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can...

8.8CVSS0.00312EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 4:16 p.m.21 views

CVE-2026-50085

The Aqara Board service op-test.aqara.com accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS...

9.8CVSS0.00412EPSS
SaveExploits1References2
NVD
NVD
added 2026/06/12 4:16 p.m.20 views

CVE-2026-50082

The Aqara Cloud Developer Portal developer.aqara.com issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.5 Medium. When...

6.5CVSS0.00266EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/06/12 3:01 p.m.24 views

EUVD-2026-36474

The Aqara Cloud Production API open-cn.aqara.com/v3.0/open/api would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N 9.6 Critical. When combined with...

9.6CVSS5.3AI score0.00266EPSS
SaveExploits2References2
Cvelist
Cvelist
added 2026/06/12 3:00 p.m.41 views

CVE-2026-50082 Aqara Developer Portal insecure authentication token

The Aqara Cloud Developer Portal developer.aqara.com issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.5 Medium. When...

6.5CVSS0.00266EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/06/12 3:00 p.m.15 views

CVE-2026-50082 Aqara Developer Portal insecure authentication token

The Aqara Cloud Developer Portal developer.aqara.com issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.5 Medium. When...

6.5CVSS5.5AI score0.00266EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/06/12 3:00 p.m.16 views

EUVD-2026-36472

The Aqara Cloud Developer Portal developer.aqara.com issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.5 Medium. When...

6.5CVSS5.4AI score0.00266EPSS
SaveExploits1References2
CVE
CVE
added 2026/06/12 3:00 p.m.47 views

CVE-2026-50082

The Aqara Cloud Developer Portal is affected by a Missing Authentication for Critical Function (CWE-306) vulnerability where a developer token could be issued to any email address, enabling an unauthenticated user to potentially take over devices when combined with CVE-2026-50083/84/85. The CVSS ...

6.5CVSS5.5AI score0.00266EPSS
SaveExploits1References2Affected Software1
Positive Technologies
Positive Technologies
added 2026/06/12 12:00 a.m.27 views

PT-2026-48906

🚨 CVE-2026-50082 The Aqara Cloud Developer Portal developer.aqara.com issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.5...

9.8CVSS6.2AI score0.00412EPSS
SaveExploits2References5
Positive Technologies
Positive Technologies
added 2026/06/12 12:00 a.m.61 views

PT-2026-48908

The Aqara Cloud Production API open-cn.aqara.com/v3.0/open/api would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N 9.6 Critical. When combined with...

9.6CVSS5.3AI score0.00244EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2026/06/12 12:00 a.m.30 views

PT-2026-48953

Name of the Vulnerable Software and Affected Versions Naxclow Smart Doorbell X3 affected versions not specified Naxclow platform affected versions not specified Description A flaw in the onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to...

8.8CVSS5.3AI score0.00312EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/05 7:22 p.m.14 views

CVE-2026-34126

TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup phase is transmitted in cleartext without encryption. Bluetooth is only used during initialization. An attacker within the Bluetooth rang...

7.5CVSS5.5AI score0.00097EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/06/04 12:00 a.m.19 views

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from a broadcast event that allows malware to overwrite the device’s default mobile device management endpoint address, potentially...

9.3CVSS5.3AI score0.00098EPSS
SaveExploits0References1
ICS
ICS
added 2026/05/28 6:00 a.m.45 views

Fourth Frontier Frontier X Mobile Application, Frontier X2

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to read and write arbitrary handle values and change clinical readings, which could result in taking control of the device and lead to patient harm. 2. RECOMMENDED PRACTICES CISA recommends users take...

8.8CVSS5.9AI score0.0028EPSS
SaveExploits0References11
Vulnrichment
Vulnrichment
added 2026/04/26 11:58 p.m.9 views

CVE-2026-42363 GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability. When interacting with variou...

9.3CVSS5.6AI score0.00186EPSS
SaveExploits0References2
Rows per page
Query Builder