CVE-2024-54082: Improper Neutralization of Special Elements used in an OS Command

home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user...

PT-2024-31740 · Unknown · Home 5G Hr02 +2

Name of the Vulnerable Software and Affected Versions: home 5G HR02 affected versions not specified Wi-Fi STATION SH-52B affected versions not specified Wi-Fi STATION SH-54C affected versions not specified Description: The issue is an OS command injection vulnerability found in the HOST name...

CVE-2024-12903: Incorrect Default Permissions

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control...

PT-2024-36023 · Unknown · Home 5G Hr02 +1

Name of the Vulnerable Software and Affected Versions: home 5G HR02 and Wi-Fi STATION SH-54C affected versions not specified Description: The issue is an OS command injection vulnerability in the configuration restore function. This allows an arbitrary OS command to be executed with root privileg...

Biamp Evoko Home 安全漏洞

Biamp Evoko Home is a conference room and desk reservation system from Biamp. A security vulnerability exists in Biamp Evoko Home that originates from a non-administrative user being able to exploit weak file and folder permissions to elevate privileges and execute arbitrary code...

CVE-2024-47864: Buffer Copy without Checking Size of Input

home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down...

CVE-2024-53275: Reliance on Reverse DNS Resolution for a Security-Critical Action

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. I...

CVE-2024-45721: Improper Neutralization of Special Elements used in an OS Command

home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user...

PT-2024-17791 · Evoko · Evoko Home

Name of the Vulnerable Software and Affected Versions: Evoko Home versions 2.4.2 through 2.7.4 Description: The issue is related to incorrect default permissions in Evoko Home, allowing a non-admin user to exploit weak file and folder permissions and potentially escalate privileges, execute...

CVE-2024-12793

A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to path traversal. The attack may be launched remotel...

This VPN Lets Anyone Use Your Internet Connection. What Could Go Wrong?

A free VPN app called Big Mama is selling access to people’s home internet networks. Kids are using it to cheat in a VR game while researchers warn of bigger security risks...

CVE-2023-4617

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

CVE-2023-4617

CVE-2023-4617 describes an incorrect authorization vulnerability in the Govee Home application (Android and iOS) that is exploitable via the HTTP POST method. A remote attacker can manipulate the request fields—device , sku , and type —to gain control of devices owned by other users. Affected ver...

PT-2024-35709 · Unknown · Home-Gallery.Org

Name of the Vulnerable Software and Affected Versions: Home-Gallery.org versions 1.15.0 and earlier Description: Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. An open CORS policy in app.js may allow an attacker to view the images of home-gallery...

PT-2024-13332 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home versions prior to 5.9 Description: The issue is related to an incorrect authorization vulnerability in the HTTP POST method in the Govee Home application on Android and iOS. This allows a remote attacker to control devices owned by...

CVE-2024-12793: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to path traversal. The attack may be launched remotel...

CVE-2023-4617: Incorrect Authorization

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

Govee Home 安全漏洞

Govee Home is an application from Govee, Inc. A security vulnerability exists in Govee Home that stems from an Authorization Error vulnerability in the HTTP POST method in the application, which allows remote attackers to take control of devices owned by other users by changing the values of the...

CVE-2024-12502

The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12502 My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...