PT-2019-13461 · Firefly Iii · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 4.7.17.3 Description: The issue is related to reflected XSS due to the lack of filtration of user-supplied data in a search query. It is noted that an attacker must have the same access rights as the user to...

Firefly CMS 1.0 Remote Command Execution Exploit #RCE

Exploit for php platform in category web applications + Remote Comand Execution on Firefly CMS v. 1.0 + Date: 11/05/2019 + CWE number: CWE-78 + Risk: High + Author: Felipe Andrian Peixoto + Contact: email protected + Tested on: Windows 7 and Linux + Vendor Homepage: https://fireflydigital.com/ +...

Firefly CMS 1.0 Remote Command Execution

Remote Comand Execution on Firefly CMS v. 1.0 + Date: 11/05/2019 + CWE number: CWE-78 + Risk: High + Author: Felipe Andrian Peixoto + Contact: [email protected] + Tested on: Windows 7 and Linux + Vendor Homepage: https://fireflydigital.com/ + Vulnerable File: site.php + Version : 1.0 +...

CVE-2019-5014

An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability...

CVE-2019-5014

An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability...

Improper access control

An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability...

CVE-2019-5014

An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability...

CVE-2019-5014

CVE-2019-5014 concerns the Winco Fireworks FireFly FW-1007 V2.0 Bluetooth Low Energy firmware, where an attacker can connect via BLE without authentication to issue launch commands. The vulnerability stems from improper access control in the BLE interface, allowing an unauthenticated attacker to ...

PT-2019-17403

Name of the Vulnerable Software and Affected Versions Winco Fireworks FireFly FW-1007 version V2.0 Description An exploitable improper access control issue exists in the Bluetooth Low Energy functionality. An attacker can connect to the device to trigger this issue. Recommendations For version...

CVE-2019-5014: Improper Access Control

An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability...

Winco Fireworks FireFly Bluetooth Low Energy Improper Access Control Vulnerability

Summary An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can connect to the device to trigger this vulnerability. Tested Versions Winco Fireworks FireFly FW-1007 V2.0 Product URLs...

Friday Squid Blogging: Firefly Squid Museum

The Hotaruika Museum is a museum devoted to firefly squid in Toyama, Japan. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Friday Squid Blogging: Eating Firefly Squid

In Tokama, Japan, you can watch the firefly squid catch and eat them in various ways: "It's great to eat hotaruika around when the seasons change, which is when people tend to get sick," said Ryoji Tanaka, an executive at the Toyama prefectural federation of fishing cooperatives. "In addition to...

Yelp: Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.

Dear Yelp bug bounty team, Summary --- Firefly is vulnerable to timing attacks, because the verifyaccesstoken function performs a byte-by-byte comparison, which terminates early when two characters do not match. Timing attacks are a type of side channel attack where one can discover valuable...

FireFly 1.0 - Local Proxy Password Disclosure Exploit

No description provided by source. / FireFly v1.0 Local Exploit by Kozan Application: FireFly v1.0 Vendor: NetCruiser Software - www.netcruiser-software.com Vulnerable Description: FireFly v1.0 discloses proxy passwords to local users. Discovered & Coded by: Kozan Credits to ATmaCA Web :...

firefly media server (mt-daapd) 2.4.1 / svn 1699 - Multiple Vulnerabilities

No description provided by source. Luigi Auriemma Application: Firefly Media Server mt-daapd http://www.fireflymediaserver.org Versions: = 2.4.1 and SVN = 1699 Platforms: nix, Windows, Mac and others Bugs: A partial directory traversal on Windows B authentication bypass on Windows C duplicated HT...

Firefly Studios Stronghold 2 Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13814/info Stronghold 2 is affected by a remote denial of service vulnerability. The issue arises when the game server handles a specially crafted packet. Stronghold 2 1.2 and prior versions are affected by this...

Firefly Media Server <= 0.2.4 - Remote Denial of Service Exploit

No description provided by source. !C:\python25\python25.exe Advisory : UPH-07-02 mt-dappd/Firefly media server remote DoS Discovered by nnp http://www.unprotectedhex.com import sys import socket import time if lensys.argv != 3: sys.exit-1 killmsg = GET /xml-rpc?method=stats HTTP/1.1\r\n...

FireFly Mediaserver 1.0.0.1359 NULL Pointer Dereference

No description provided by source...

CVE-2012-5875

Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service NULL pointer dereference via a 1 crafted Connection HTTP header; a return carriage control character in the 2 Accept Language header, 3 User-agent header, 4 Host header, or 5 protocol version; or a 6 crafted HTTP...