CVE-2018-12563

CVE-2018-12563 (Linaro LAVA) affects LAVA prior to 2018.5.post1. The issue arises from the system’s handling of file: URLs, allowing a user to coerce lava-server-gunicorn to download any file from the filesystem that is readable by lavaserver and presented as valid YAML. This constitutes an arbit...

CVE-2018-12564

CVE-2018-12564 affects LAVA (lava-server) where support for URLs in the submit page can be abused to force lava-server-gunicorn to read arbitrary server files readable by lavaserver and containing valid YAML. Impact per the sources is information disclosure (no explicit compromise of integrity/av...

Linaro LAVA Information Disclosure Vulnerability

Linaro LAVA is an automated verification system. The system is primarily used to test the deployment of device systems based on ARM cores. A security vulnerability exists in Linaro LAVA versions prior to 2018.5.post1. An attacker can exploit this vulnerability by forging an HTTP request to force...

Linaro LAVA Arbitrary File Download Vulnerability

Linaro LAVA is an automated verification system. The system is primarily used to test the deployment of device systems based on ARM cores. A security vulnerability exists in Linaro LAVA versions prior to 2018.5.post1, which stems from the program's support for file: URLs.An attacker could use thi...

Linaro LAVA Remote Code Execution Vulnerability

Linaro LAVA is an automated verification system. The system is primarily used to test the deployment of device systems based on ARM cores. A security vulnerability exists in Linaro LAVA versions prior to 2018.5.post1, which stems from the program using the 'yaml.load' function instead of the...

CVE-2017-14003

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link ESL running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass...

Authentication flaw

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link ESL running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass...

CVE-2017-14003

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link ESL running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass...

CVE-2017-14003

The CVE-2017-14003 issue affects LAVA Computer MFG Ether-Serial Link (ESL) devices running firmware 6.01.00/29.03.2007 and earlier. An improper authentication vulnerability allows an attacker with the same IP address to bypass authentication by accessing a specific resource locator, effectively e...

CVE-2017-14003

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link ESL running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass...

LAVA Computer MFG Ether-Serial Link Authentication Bypass Vulnerability

Ether-Serial Link is an Ethernet serial link device from LAVA Computer MFG. An authentication bypass vulnerability exists in LAVA Computer MFG Ether-Serial Link versions 6.01.00/29.03.2007 and earlier, which can be exploited by an attacker with the same IP address to bypass authentication by...

Iron Lava Corp Shell Upload / SQL Injection

Exploit Title : Iron Lava Corp SQL Injection / SHell upload Exploit Author : Ashiyane Digital Security Team vendor home : http://www.ironlava.com/ Home : www.ashiyane.org Security Risk : High Dork : "Site Design by Iron Lava Corp." inurl:index.php?pid= Location:site/index.php?pid=SQL DEm0:...

Lava CMS SQL Injection

. . . . | | | / || \ \ | / | | / \ / | / \ / \ / \ / /| |\ \ / \ / \ / / \ / | / \ \ \ | || | / // | | | \ / \ \ | | / | | \ \ / // | \ / | | / |||| /\ | / || / \ / || /|| / \ / / \ | \ || / / / / / / / / / /...

Lava (news_item.php?id) (album.php?id) (basket.php?baction) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Lava newsitem.php?id album.php?id basket.php?baction AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.lava.com.ua/ Persian Gulf 4 Ever! Dork : " "Lava""...

Lava SQL Injection

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Lava newsitem.php?id album.php?id basket.php?baction AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.lava.com.ua/ Persian Gulf 4 Ever! Dork : "Разработано в компании...

Linux news 16.05.00

Open Source Motif Open Group открыла исходники Motif. Motif - это набор для создания и обслуживания кнопочек, полос прокрутки и так далее. В общем, как Qt, только Motif. Netscape для Linux использует именно его. Подробнее: http://www.opengroup.org/openmotif/ Bluefish 0.4 Появилось сообщение о том...