CVE-2020-5783

CVE-2020-5783 affects IgniteNet HeliOS GLinq v2.2.1 r2961. The connected documents provide concrete detail: the login functionality lacks CSRF protection, creating a CSRF risk for authenticated sessions. No explicit exploit details, affected components beyond the login mechanism, or remediation s...

CVE-2020-5783: Cross-Site Request Forgery (CSRF)

In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms...

CVE-2020-5781: Improper Neutralization of Input During Web Page Generation

In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file /etc/config/luci by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users...

PT-2020-18702

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The issue arises from the storage of the langSelection parameter in the luci configuration file /etc/config/luci by the authenticator.htmlauth function. This can be modified with arbitrary...

PT-2020-18703

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The issue occurs when a user logs in and sets the wan type parameter, causing the wan interface to become unreachable. This results in a denial of service condition for devices that depend...

PT-2020-18704

Name of the Vulnerable Software and Affected Versions IgniteNet HeliOS GLinq version 2.2.1 r2961 Description The login functionality in the affected software lacks CSRF protection mechanisms, which could potentially allow for unauthorized actions. Recommendations For version 2.2.1 r2961, consider...

CVE-2020-5782: Undefined Security Weakness

In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wantype’ parameter, the wan interface for the device will become unreachable, which results in a denial of service condition for devices dependent on this connection...

Dark Nexus: A New Emerging IoT Botnet Malware Spotted in the Wild

Cybersecurity researchers have discovered a new emerging IoT botnet threat that leverages compromised smart devices to stage 'distributed denial-of-service' attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. The botnet, named "darknexus" by Bitdefender...

Helios Calendar 1.1/1.2 Admin/Index.PHP Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in ...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5952

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5952

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-5952

The vulnerability CVE-2007-5952 targets Helios Calendar 1.2.1 Beta, affecting the admin/index.php component. It is a Cross-site Scripting (XSS) flaw that allows an attacker to inject arbitrary script or HTML through the username parameter. The root cause is unvalidated input in the username field...

CVE-2007-5952: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Helios Calendar 1.2.1 Beta allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

helios-xss.txt

Hi PacketStormSecurity.org; I'm reporting a vulnerability of type XSS in Helios Calendar, thank you for all. +==============================================================================+ + Helios Calendar =1.2.1 Beta XSS Multiple Remote Vulnerabilities +...

Helios Calendar 1.11.2 - adminindex.php Cross-Site Scripting

Helios Calendar 1.11.2 - adminindex.php Cross-Site Scripting source: https://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute...

Helios Calendar 1.1/1.2 - 'admin/index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the...