CVE-2018-3880

CVE-2018-3880 affects Samsung SmartThings Hub STH-ETH-250 with Firmware 0.20.17. The vulnerability is a stack-based buffer overflow in the video-core HTTP server’s database function find-by-cameraId, triggered by crafting HTTP requests that interact with the SQLite data when deleting/handling cam...

CVE-2018-3872

CVE-2018-3872 is a buffer overflow in Samsung SmartThings Hub video-core HTTP server (credentials handler). The vulnerability arises when user-controlled JSON payloads supply videoHostUrl; the server copies the parsed URI into a fixed-size stackBuffer without length checks, enabling stack-based o...

Stack overflow

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

Memory corruption

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request...

CVE-2018-1158

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

CVE-2018-1158

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

Memory corruption

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting...

CVE-2018-1158

CVE-2018-1158 affects MikroTik RouterOS before 6.40.9 and 6.42.7. It is a stack-exhaustion flaw where an authenticated remote attacker can crash the HTTP server by recursively parsing JSON. The issue is mitigated by upgrading RouterOS to 6.40.9, 6.42.7 or later (e.g., 6.43).

CVE-2018-1159

CVE-2018-1159 affects MikroTik RouterOS before 6.42.7 and 6.40.9. It is a memory corruption flaw in the HTTP server that lets an authenticated remote attacker crash the HTTP service by rapidly authenticating and disconnecting. Affected devices are RouterOS-based routers; underlying issue is a mem...

CVE-2018-1157

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request...

CVE-2018-1159

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting...

CVE-2018-1158

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON...

CVE-2018-1157

CVE-2018-1157 affects MikroTik RouterOS prior to 6.42.7 and 6.40.9. The issue is a memory-exhaustion vulnerability where an authenticated remote attacker can crash the HTTP server (and in some cases reboot the device) by sending a crafted HTTP POST request. Impact is the HTTP service denial and p...

CVE-2018-3902

An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a...

CVE-2018-3902

An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a...

CVE-2018-3919

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the "clips" table of its SQLite...

CVE-2018-3905

An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading t...

CVE-2018-3925

An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-hos...

Buffer overflow

Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buff...

Sql injection

An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in...