CVE-2024-53275 GHSL-2024-091: DNS rebinding attack in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. I...

CVE-2024-53275 GHSL-2024-091: DNS rebinding attack in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. I...

CVE-2024-53275

Home-Gallery.org (versions 1.15.0 and earlier) is vulnerable to DNS rebinding due to default exposure without TLS or authentication. An attacker can lure a user to a malicious site, then switch DNS to point to the internal Home-Gallery host and read the web server’s responses, potentially exfiltr...

CVE-2024-12903

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control...

CVE-2024-12903 Incorrect default permissions in Biamp Evoko Home

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control...

CVE-2024-12903 Incorrect default permissions in Biamp Evoko Home

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control...

CVE-2024-12903

CVE-2024-12903 concerns Biamp Evoko Home, affected in versions 2.4.2–2.7.4. The root cause is “incorrect default permissions” leading to full-control on the Everyone group, enabling a non-admin user with local access to escalate privileges, execute arbitrary code, and maintain persistence on the ...

CVE-2024-54082

The CVE-2024-54082 issue affects SHARP-driven home/router devices (home 5G HR02 and Wi‑Fi STATION SH-54C). It is an OS command injection in the configuration restore function that can allow an administrator to execute arbitrary commands with root privileges. Affected versions include home 5G HR02...

CVE-2024-54082

home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user...

Sharp SH-52B、SH-54C和HR02 操作系统命令注入漏洞

The Sharp HR02 and others are products of Sharp Corporation Japan.The Sharp HR02 is a home router.The Sharp SH-52B is a wireless LAN connectivity station.The Sharp SH-54C is a wireless LAN connectivity station. The Sharp SH-52B, SH-54C, and HR02 are vulnerable to an operating system command...

PT-2024-36023 · Unknown · Home 5G Hr02 +1

Name of the Vulnerable Software and Affected Versions: home 5G HR02 and Wi-Fi STATION SH-54C affected versions not specified Description: The issue is an OS command injection vulnerability in the configuration restore function. This allows an arbitrary OS command to be executed with root privileg...

Biamp Evoko Home 安全漏洞

Biamp Evoko Home is a conference room and desk reservation system from Biamp. A security vulnerability exists in Biamp Evoko Home that originates from a non-administrative user being able to exploit weak file and folder permissions to elevate privileges and execute arbitrary code...

PT-2024-31740 · Unknown · Home 5G Hr02 +2

Name of the Vulnerable Software and Affected Versions: home 5G HR02 affected versions not specified Wi-Fi STATION SH-52B affected versions not specified Wi-Fi STATION SH-54C affected versions not specified Description: The issue is an OS command injection vulnerability found in the HOST name...

PT-2024-17791 · Evoko · Evoko Home

Name of the Vulnerable Software and Affected Versions: Evoko Home versions 2.4.2 through 2.7.4 Description: The issue is related to incorrect default permissions in Evoko Home, allowing a non-admin user to exploit weak file and folder permissions and potentially escalate privileges, execute...

This VPN Lets Anyone Use Your Internet Connection. What Could Go Wrong?

A free VPN app called Big Mama is selling access to people’s home internet networks. Kids are using it to cheat in a VR game while researchers warn of bigger security risks...

CVE-2023-4617

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

CVE-2023-4617

CVE-2023-4617 describes an incorrect authorization vulnerability in the Govee Home application (Android and iOS) that is exploitable via the HTTP POST method. A remote attacker can manipulate the request fields—device , sku , and type —to gain control of devices owned by other users. Affected ver...

PT-2024-13332 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home versions prior to 5.9 Description: The issue is related to an incorrect authorization vulnerability in the HTTP POST method in the Govee Home application on Android and iOS. This allows a remote attacker to control devices owned by...

Govee Home 安全漏洞

Govee Home is an application from Govee, Inc. A security vulnerability exists in Govee Home that stems from an Authorization Error vulnerability in the HTTP POST method in the application, which allows remote attackers to take control of devices owned by other users by changing the values of the...

PT-2024-35709 · Unknown · Home-Gallery.Org

Name of the Vulnerable Software and Affected Versions: Home-Gallery.org versions 1.15.0 and earlier Description: Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. An open CORS policy in app.js may allow an attacker to view the images of home-gallery...