CVE-2018-1000626

CVE-2018-1000626 affects Battelle V2I Hub 2.5.1. The vulnerability stems from not changing the default API key, enabling a remote attacker to bypass security restrictions by using any API function with the unchanged key, to gain unauthorized access. Documented across multiple sources (NVD, CNVD/C...

CVE-2018-1000629

Battelle V2I Hub 2.5.1 is affected by a Cross-Site Scripting vulnerability (CVE-2018-1000629). The issue arises from improper validation in api/SystemConfigActions.php?action=add and the index.php script, enabling a remote attacker to craft URLs using parameterName or _login_username to execute s...

CVE-2018-1000628

The CVE-2018-1000628 entry concerns Battelle V2I Hub 2.5.1, where a security-restriction bypass is caused by comparing an API key against a user-supplied value via PHP’s $_GET using strcmp. By appending [] to the key parameter in API function URLs, an attacker could bypass checks and execute API ...

CVE-2018-1000631

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

CVE-2018-1000628

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp function. By adding "" to the end of "key" in the URL when accessing API functions...

CVE-2018-1000627

Battelle V2I Hub 2.5.1 exposes an API key due to failure to restrict access to the API key file, enabling remote attackers to obtain the current API key and gain unauthorized access. This information disclosure vulnerability is described across CVE-2018-1000627 sources (NVD/CNVD) with consistent ...

CVE-2018-1000624

CVE-2018-1000624 affects Battelle V2I Hub 2.5.1. The root cause is failure to restrict access to a sensitive function, enabling a remote attacker to shut down the system by visiting http://V2I_HUB/UI/powerdown.php. Documented impact is Denial of Service with high availability impact; CVSS metrics...

CVE-2018-1000629

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or loginusername parameter in a...

CVE-2018-1000625

Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account. An attacker could exploit this vulnerability to log in as an admin on any installation and gain unauthorized access to the system...

CVE-2018-1000625

The CVE-2018-1000625 vulnerability affects Battelle V2I Hub 2.5.1 and is caused by hard-coded credentials for the administrative account, allowing an attacker to log in as an admin and gain unauthorized access to the system. The connected CNVD/NVD entries corroborate the description. No concrete ...

CVE-2018-1000624

Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality. By visiting http://V2IHUB/UI/powerdown.php, a remote attacker could exploit this vulnerability to shut down the system...

CVE-2018-1000627

Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API key file. An attacker could exploit this vulnerability to obtain the current API key to gain unauthorized access to the system...

Microsoft Visual Studio 'Diagnostic Hub Standard Collector' Elevation of Privilege Vulnerability

This host is missing an important security update according to Microsoft Security Update December-2018. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Logitech Harmony Hub OS Command Injection Vulnerability

Logitech Harmony Hub is a remote control device from Logitech USA. An operating system command injection vulnerability exists in Logitech Harmony Hub versions prior to 4.15.206, which can be exploited by an attacker to inject operating system commands by sending a time update request...

Logitech Harmony Hub Command Injection Vulnerability

Logitech Harmony Hub is a remote control device from Logitech USA. A command injection vulnerability exists in Logitech Harmony Hub versions prior to 4.15.206, which can be exploited by a remote attacker to execute application-defined commands e.g., harmony.system?systeminfo by sending a speciall...

Command injection

The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response...

CVE-2018-15721

The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...

CVE-2018-15720

Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...

Authentication flaw

The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...

CVE-2018-15722

The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response...