Data Privacy in the Age of IoT

On Data Privacy Day, January 28th, we should have all taken a few moments to think more carefully about safeguarding our personal data, staying safe online, and improving our privacy habits. Just what does that mean in the age of IoT — the Internet of Things? In previous years, cyber threats most...

The vulnerability of AtHome IP Camera’s microprogramming software lies in the lack of measures to clean incoming data, allowing intruders to execute arbitrary commands.

The vulnerability of AtHome IP Camera microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands using the “noodles” service running on port 1300...

Command Execution Vulnerability in CM113-Z, the Smart Home Gateway of China Mobile Communications Corporation

China Mobile Smart Home Gateway CM113-Z is a universal gateway device from China Mobile. A command execution vulnerability exists in the CM113-Z, a smart home gateway from China Mobile Communications. An attacker can exploit the vulnerability to execute arbitrary system commands on the device...

VulnCheck KEV: CVE-2015-2052

Stack-based buffer overflow in the DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary code via a long string in a GetDeviceSettings action to the HNAP interface...

Multiple vulnerabilities in the Family Matters App

The Home Care App is a professional home service booking online platform. Worry-Free Home App suffers from arbitrary account login and cross-site scripting vulnerabilities, which can be exploited by an attacker to login to any account, insert cross-site code, and obtain sensitive information such...

karaca-home.com XSS vulnerability

Open Bug Bounty ID: OBB-531120 Description| Value ---|--- Affected Website:| karaca-home.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bplans.com XSS vulnerability

Open Bug Bounty ID: OBB-524419 Description| Value ---|--- Affected Website:| bplans.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure...

Description of the security update for Office 2016: January 9, 2018 (KB4011622)

None None...

Plone JavaScript Code Execution Vulnerability

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A code...

Fixing the Meltdown and Spectre vulnerabilities

Two days ago, Graz University of Technology published a paper describing a pair of attacks on common microprocessors. The underlying vulnerability affects Intel, AMD, and ARM processors. All contemporary microprocessors pre-execute instructions. In other words, the vulnerability bypasses address...

home-max.bg XSS vulnerability

Open Bug Bounty ID: OBB-483997 Description| Value ---|--- Affected Website:| home-max.bg Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based o...

ideas-for-home.ch XSS vulnerability

Open Bug Bounty ID: OBB-483929 Description| Value ---|--- Affected Website:| ideas-for-home.ch Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on ISO 29147 guidelines...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

Huawei UPnP DeviceUpgrade command injection

Added: 01/02/2018 BID: 102344 Background Huawei home routers support the DeviceUpgrade service type over the Universal Plug and Play UPnP protocol to facilitate upgrading of firmware. Problem A remote authenticated attacker can execute arbitrary commands injected into the NewStatusURL XML element...

Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP1000 'getchart' Shell via Command Injection v3.1-3.5-RC7", 'Description' = % This module exploits an OS Command Injection vulnerabilit...

Joomla SP Movie Database 1.4 SQL Injection

Exploit Title: SP Movie Database - SQL Injection Vulnerability Google Dork: inurl:option=comspmoviedb Date: 29.12.2017 Author: pwny Source Component : https://extensions.joomla.org/extension/sp-movie-database/ Version : 1.4 Tested on: Kali Linux proof : https://ibb.co/cjdiZw Search Form in Home...

Horde Groupware SQL Injection Vulnerability

Horde Groupware is an enterprise browser based on the Communication Suite from Horde USA. The browser supports sending and receiving e-mail, managing and sharing calendars, contacts and tasks, and more. A SQL injection vulnerability exists in Horde Groupware 5.2.22 and earlier versions. A remote...

Amazon's Door Lock Is Amazon's Bid to Control Your Home

Interesting essay about Amazon's smart lock: When you add Amazon Key to your door, something more sneaky also happens: Amazon takes over. You can leave your keys at home and unlock your door with the Amazon Key app -- but it's really built for Amazon deliveries. To share online access with family...

SUSE-SU-2017:3380-1 Security update for Salt

This update for salt fixes one security issue and bugs. The following security issues have been fixed: - CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. bsc1062462 -...

asia-home.com XSS vulnerability

Open Bug Bounty ID: OBB-455070 Description| Value ---|--- Affected Website:| asia-home.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...