236 matches found
Design/Logic Flaw
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-11649
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-11649
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-11649
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-11649
Hue 3.12 contains a Cross-Site Scripting (XSS) vulnerability in the /pig/save/ name and script parameters. The CNVD/Red Hat/NVD entries describe an XSS that could allow injection of arbitrary web script or HTML, implying an impact to user sessions and partial integrity for affected deployments. R...
CVE-2015-8094
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...
Open redirect
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...
CVE-2015-8094
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...
CVE-2015-8094
CVE-2015-8094 is an open redirect vulnerability in Cloudera Hue prior to 3.10.0. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via a URL supplied in the next parameter. Affected software: Cloudera Hue before 3.10.0. Root cause and exploit details are ...
Hijacking Philips Hue
We were filming a smart home hacking piece on the 5th May this year. Like most home users, the Wi-Fi PSK wasn’t strong enough, so we cracked it and joined the network. The user had a Philips Hue lighting system. None of us here had looked at Hue before - we made an assumption after the previous...
CVE-2017-14797
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...
CVE-2017-14797
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...
Design/Logic Flaw
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...
CVE-2017-14797
The CVE-2017-14797 entry concerns Philips Hue Bridge BSB002 public API on firmware 1707040932, where a lack of transport encryption enables an attacker on the local intranet to sniff HTTP traffic and read API keys. This bypasses the pushlink protection and can, per cited sources, allow full contr...
CVE-2017-14797
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...
Philips Hue gen 1 - Customized SSL, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application Philips Hue gen 1 published at the 'play' market has multiple vulnerabilities...
Philips Hue - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application Philips Hue published at the 'play' market has multiple vulnerabilities...
Cloudera HUE Configuration file world readable
The hue.ini configuration file is by default accessible to anyone with the other permission set to read: $ ls -al /etc/hue/conf/hue.ini -rw-rw-r-- 1 root root 22813 Nov 18 2015 /etc/hue/conf/hue.ini Several account credentials can be found in that configuration file such as: Database account: thi...
Cloudera HUE Session cookies stored in the database
User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...