CVE-2021-3152

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Hom...

CVE-2021-3152

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Hom...

Directory traversal

DISPUTED Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant;...

Home Assistant 路径遍历漏洞

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A directory traversal vulnerability exists in Home Assistant prior to version 2021.1.3. The vulnerability stems from a failure to properly filter for special elemen...

CVE-2021-3152

Summary: CVE-2021-3152 affects Home Assistant before 2021.1.3, describing a directory-traversal risk in custom integrations. The vulnerability is framed as arising from third-party integrations, not Home Assistant itself, though a security update is recommended. Affected product/area: Home Assist...

CVE-2021-3152

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Hom...

CVE-2021-3152: Improper Limitation of a Pathname to a Restricted Directory

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Hom...

PT-2021-19401

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2021.1.3 Description The issue is related to a lack of protection against directory-traversal attacks in custom integrations. It is noted that the vendor views the vulnerability as being in custom integrations...

Home Assistant Information Disclosure Vulnerability

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. An information disclosure vulnerability exists in Home Assistant versions prior to 0.67.0, which can be exploited to read the application's error logs with the help...

CVE-2018-21019

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

PYSEC-2019-221

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

Information disclosure

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

PYSEC-2019-221

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

CVE-2018-21019

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

CVE-2018-21019

Home Assistant pre-0.67.0 contains an information-disclosure vulnerability: an unauthenticated attacker can read the application’s error log via components/api.py. A fix is available in the 0.67.0 release and newer (per release and advisories). No exploitation details are provided beyond this in ...

CVE-2018-21019: Exposure of Sensitive Information to an Unauthorized Actor

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py...

Home Assistant Dashboard No Password (HTTP)

By default, the full control dashboard in older versions of Home Assistant does not require a password. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Home Assistant Detection (HTTP)

HTTP based detection of Home Assistant. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.113249";...

Qualys: Cloud Security Must Move Towards ‘Transparent Orchestration’

What does the “My Little Pony” television series and cyber security have in common? Ask Qualys Chief Product Officer Sumedh Thakar. Whenever his 7-year old daughter wanted to see an episode of this show, the process involved multiple steps: Turning on the smart TV, scrolling through the app menu,...

Home Assistant Cross-Site Scripting Vulnerability

Home Assistant is an open source platform for automated management of home network devices. A cross-site scripting vulnerability exists in versions of Home Assistant prior to 0.57. A remote attacker can exploit this vulnerability to inject JavaScript code via specially crafted Markdown text...