CVE-2017-17737

BrightSign Digital Signage (4k242) devices running firmware 6.2.63 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability in the REF parameter of /network_diagnostics.html and /storage_info.html. The issue originates from input not being validated, enabling injection that could le...

CVE-2017-17738

Summary: CVE-2017-17738 affects BrightSign Digital Signage (4k242) devices with firmware 6.2.63 and earlier. The vulnerability allows renaming and modifying files via the web page /tools.html, as described in CNVD/NVD entries for this device. Public write-access via a web interface is indicated, ...

CVE-2017-17739

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files...

CVE-2017-17738

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

Neoscreen 4.5 Cross Site Scripting

Exploit Title: Neoscreen Cross-site scripting Product: Neoscreen by Cube Digital Media Vulnerable Versions: 4.5 and all previous versions Tested Version: 4.5 Advisory Publication: July 24, 2016 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: NONE Credit: Alex Haynes Advisory Detail...

Mango Signs - Digital Signage - WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Mango Signs - Digital Signage published at the 'play' market has multiple vulnerabilities...

NoviSign Digital Signage - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application NoviSign Digital Signage published at the 'play' market has multiple vulnerabilities...

firmCHANNEL Indoor & Outdoor Digital Signage 3.24 Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/32107/info firmCHANNEL Indoor & Outdoor Digital SIGNAGE is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitra...

CVE-2013-4888

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page...

CVE-2013-4889

Multiple cross-site request forgery CSRF vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new administrator via the AddUser action or 2 conduct cross-site scripting XSS attacks, as demonstrat...

Sql injection

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...

CVE-2013-4887

CVE-2013-4887 affects Digital Signage Xibo 1.4.2. The vulnerability is a SQL injection in the web interface (index.php) that can be exploited via the displayid parameter to execute arbitrary SQL commands. Documented impact indicates remote attackers may obtain partial confidentiality/integrity/av...

CVE-2013-4888

CVE-2013-4888 (Digital Signage Xibo 1.4.2) is a documented XSS in index.php via the layout parameter on the layout page; CVE-2013-4889 describes CSRF that can hijack admin actions (e.g., AddUser) and, as noted, can enable XSS through the same page. Exploitation details are present (e.g., CSRF exp...

CVE-2013-4887

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter...

CVE-2013-4889

CVE-2013-4889 is a vulnerability in Digital Signage Xibo 1.4.2 where CSRF in index.php can hijack administrator sessions by performing actions such as adding a new administrator via the AddUser action. The entry aggregates related issues, noting that this vulnerability enables requests performed ...

PT-2014-2876

Name of the Vulnerable Software and Affected Versions Digital Signage Xibo version 1.4.2 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the displayid parameter in the "index.php" file. Recommendations For Digital Signage Xibo...

Xibo - Cross-Site Request Forgery

Xibo - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/62064/info Xibo is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks...

Xibo 1.2.2 / 1.4.1 Directory Traversal

Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References: http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-DS-2013-00 Affected Vendor: Spring Signage Ltd Affected...

Xibo 1.2.2/1.4.1 - 'index.php?p' Directory Traversal

Exploit Title: Xibo Directory Traversal Vulnerability Exploit Author: Mahendra Date: 2 April 2013 Vendor homepage: http://xibo.org.uk References: http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-DS-2013-00 Affected Vendor: Spring Signage Ltd Affected...