CVE-2023-41895

CVE-2023-41895 affects Home Assistant Core. The issue is a cross-site scripting (XSS) vulnerability on the login/redirect flow: the frontend fetches the client_id and checks for tags, but those URLs are not subject to the same scheme validation, allowing arbitrary javascript: URIs to execute on ...

CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core

Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks...

CVE-2023-41897

CVE-2023-41897 affects Home Assistant Core. The issue is the absence of HTTP security headers, notably the X-Frame-Options header, which enables clickjacking and creates potential paths for other exploit opportunities within the Home Assistant web interface. Documents consistently describe the ri...

CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...

PT-2023-8301 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. The specific flaw exists within the prog.cgi binary,...

Symcon IP-Symcon 路径遍历漏洞

Symcon IP-Symcon is Symcon's complete solution for the home automation space. A security vulnerability exists in Symcon IP-Symcon versions prior to 6.3 that stems from allowing a remote attacker to read sensitive files via a URL in the... directory traversal sequence to read sensitive files...

Panasonic AiSEG2 操作系统命令注入漏洞

Panasonic AiSEG2 is a series of home IoT products from Panasonic Corporation Panasonic of Japan. A security vulnerability exists in Panasonic AiSEG2 version 2.80F through 2.93A. An attacker could exploit the vulnerability to execute arbitrary operating system commands...

CVE-2023-27482

CVE-2023-27482 affects Home Assistant Supervisor (not Home Assistant Container or Core in Python) via a remotely exploitable authentication bypass of the Supervisor API. Affected installations are those using Supervisor 2023.01.1 or older. Mitigation: Supervisor 2023.03.1 has been rolled out to a...

Z-Wave 安全特征问题漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low power consumption radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems,...

Z-Wave 安全漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low power consumption radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems,...

Z-Wave 安全漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low-power radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems, thermostats,...

Unspecified Vulnerability in AVE DOMINAplus

AVE DOMINAplus is an application system from AVE Italy. The best home automation system for next generation houses. A security vulnerability exists in AVE DOMINAplus version 1.10.x and prior versions, which stems from the presence of an authentication bypass vulnerability. An attacker can exploit...

AVE DOMINAplus 安全漏洞

AVE DOMINAplus is an application system from AVE Italy. The best home automation system for next generation houses. A security vulnerability exists in AVE DOMINAplus 1.10.x which stems from the presence of a plaintext credential disclosure vulnerability...

AVE DOMINAplus 访问控制错误漏洞

AVE DOMINAplus is an application system from AVE Italy. The best home automation system for next generation houses. AVE DOMINAplus version 1.10.x is vulnerable to an Access Control Error vulnerability, which can be exploited by an attacker who can use this issue to cause a Denial of Service...

CVE-2020-21987

HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting XSS. XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's...

Subreddit Home Automation 授权问题漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. Subreddit Home Automation 3.3.2 suffers from a security vulnerability that stems from an authentication bypass vulnerability when spoofing a client IP address using the X-Forwarded-For head...

Subreddit Home Automation 跨站脚本漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. Subreddit Home Automation 3.3.2 suffers from a cross-site scripting vulnerability that stems from an XSS vulnerability when input passed to multiple scripts via multiple parameters is not...

Subreddit Home Automation 操作系统命令注入漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. A security vulnerability exists in Subreddit Home Automation 3.3.2, which stems from authenticated OS command execution in the custom command v0.1 plugin...

Subreddit Home Automation 跨站请求伪造漏洞

Subreddit Home Automation is an automation device for the Subreddit community. An automated electric light. A cross-site request forgery vulnerability exists in HomeAutomation version 3.3.2 that allows a user to perform certain actions via an HTTP request without performing any validity checks to...

CVE-2021-21266

openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity XXE attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from th...