Authentication flaw

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android, which results in an attacker being able to reuse cookies to bypass authentication and...

razorCMS Settings Component Cross-Site Scripting Vulnerability

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site scripting vulnerability exists in the Settings component of razorCMS version 3.4.7, which can be exploited by a remote attacker to...

Security Vulnerability in Smart Electric Outlets

A security vulnerability in Belkin's Wemo Insight "smartplugs" allows hackers to not only take over the plug, but use it as a jumping-off point to attack everything else on the network. From the Register: The bug underscores the primary risk posed by IoT devices and connected appliances. Because...

kids24.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-675472 Description| Value ---|--- Affected Website:| kids24.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cheating in Bird Racing

I've previously written about people cheating in marathon racing by driving -- or otherwise getting near the end of the race by faster means than running. In China, two people were convicted of cheating in a pigeon race: The essence of the plan involved training the pigeons to believe they had tw...

Samsung SmartThings Hub Buffer Overflow Vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of the video-core HTTP server in Samsung SmartThings Hub STH-ETH-250 using firmware...

Home Assistant Dashboard No Password (HTTP)

By default, the full control dashboard in older versions of Home Assistant does not require a password. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Domoticz Detection

Checks if Domoticz Smart Home Software is running on the target host. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Home Assistant Detection (HTTP)

HTTP based detection of Home Assistant. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.113249";...

Belkin IoT Smart Plug Flaw Allows Remote Code Execution in Smart Homes

A vulnerability in a popular Wi-Fi–connected electric outlet for smart homes would allow a remote attacker to take over smart TVs and other devices, as well as execute code – potentially exposing tens of thousands of consumers to cryptomining, ransomware, information disclosure, botnet enslavemen...

Linux PAM 0.6.9 Authentication Replay Vulnerability

Exploit for linux platform in category local exploits Multiple Vulnerabilities in pampkcs11 ====================================== Overview - -------- Confirmed Affected Versions: 0.6.9 Confirmed Patched Versions: - Vendor: Unmaintained Vendor URL: https://github.com/OpenSC/pampkcs11 Credit: X41...

Open MQTT Servers Raise Physical Threats in Smart Homes

Tens of thousands of consumer-grade Internet of Things IoT servers have been found wide-open on the internet, allowing cybercriminals to potentially compromise homeowners’ physical security. Bad actors can gain complete access to smart-home footprints to track owners’ movements, see if smart door...

luxuryhomerentals.com XSS vulnerability

Open Bug Bounty ID: OBB-664972 Description| Value ---|--- Affected Website:| luxuryhomerentals.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Command Execution Vulnerability in Controller Technology's Little K Smart App

Controller smart home through cutting-edge wireless technology to upgrade the home electrical equipment networking, so as to realize a variety of whole-house intelligent scene. The controller has a variety of smart sockets, designed in a compact form with a variety of functions, with a linkage...

CVE-2018-15125

Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...

CVE-2018-15123

Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home...

Default configuration

Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home...

Design/Logic Flaw

Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device...

Information disclosure

Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface...

CVE-2018-15124

Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device...