1440 matches found
CVE-2018-16287
LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16286
LG SuperSign CMS suffers an authentication bypass: if a captcha:pass cookie is present and the PIN is limited to four digits, CAPTCHA is skipped and access can be gained without proper authentication. Multiple sources (NVD/NVD-derived records and CNVD) describe this flaw and its impact; CVSS metr...
CVE-2018-16287
LG SuperSign CMS is affected by a file-upload vulnerability exploitable via signEzUI/playlist/edit/upload/..%2f URIs. The NVD entry CVE-2018-16287 documents a high-severity issue (CVSS v3.0: 9.8, Network attack, no authentication, no user interaction) leading to partial confidentiality, integrity...
CVE-2018-16288
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16286
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...
CVE-2018-16288
Affected product: LG SuperSign EZ CMS 2.5. Vulnerability: Local File Inclusion (LFI) in signEzUI/playlist/edit/upload/..%2f URIs allows reading arbitrary files on the device. The Nuclei template and Open Source disclosures confirm this LFI condition, with paths such as signEzUI/playlist/edit/uplo...
CVE-2018-16706
LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...
CVE-2018-16706
CVE-2018-16706 affects LG SuperSign CMS. The issue allows remote reboot of TVs without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080. Root cause details are not elaborated in the provided documents beyond the reboot mechanism. Impact is high availability loss ...
CVE-2018-16286: Improper Authentication
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...
CVE-2018-16706: Direct Request
LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsrserver/device/reboot on port 9080...
PT-2018-13464
Name of the Vulnerable Software and Affected Versions LG SuperSign CMS affected versions not specified Description The issue allows authentication bypass. This is possible because the CAPTCHA requirement can be skipped by sending a captcha:pass cookie. Additionally, the PIN is limited to four...
CVE-2018-16288: Exposure of Sensitive Information to an Unauthorized Actor
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...
CVE-2018-16287: Unrestricted Upload of File with Dangerous Type
LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs...
PT-2018-13466
Name of the Vulnerable Software and Affected Versions LG SuperSign CMS affected versions not specified Description The issue allows for the reading of arbitrary files through specific URIs, such as signEzUI/playlist/edit/upload/..%2f. Recommendations At the moment, there is no information about a...
PT-2018-13465
Name of the Vulnerable Software and Affected Versions LG SuperSign CMS affected versions not specified Description The issue concerns a file upload vulnerability. It allows file upload via /signEzUI/playlist/edit/upload/..%2f URIs. Recommendations At the moment, there is no information about a...
CVE-2018-16946
LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...
Improper access control
LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...
CVE-2018-16946
CVE-2018-16946 affects LG LNB*, LND*, LNU*, LNV* smart IP cameras. The issue is broken access control that allows unauthenticated users to download /updownload/t.report and backup files (download.php), exposing credentials and configuration. Backup filenames can be discovered via logs/report data...
CVE-2018-16946
LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...
CVE-2018-16946: Files or Directories Accessible to External Parties
LG LNB, LND, LNU, and LNV smart network camera devices have broken access control. Attackers are able to download /updownload/t.report aka Log & Report files and download backup files via download.php without authenticating. These backup files contain user credentials and configuration informatio...