Sinapsi eSolar Light Plaintext Passwords Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified plain text passwords in Sinapsi’s eSolar Light application. Sinapsi has produced a new version to mitigate this vulnerability. AFFECTED PRODUCTS The following Sinapsi eSolar Light versions are affected: Sinapsi eSolar Light firmware versio...

Microsoft Windows Error Reporting Security Mechanism Bypass Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. A security bypass vulnerability exists in Microsoft Windows Error Reporting WER that could allow an administrative user to view the contents of process memory protected by "Protected Process Light.", resulting in the disclosure of...

CVE-2015-0001

The Windows Error Reporting WER component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging...

CVE-2015-0001: Undefined Security Weakness

The Windows Error Reporting WER component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging...

PT-2015-4384

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue Description A security feature bypass issue exists in the Windows Error Reporting WER component, allowing administrative users to bypass the Protected Proces...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMS Papoo Light 6.0.0 Rev 4701 allow remote attackers to inject arbitrary web script or HTML via the 1 author field to guestbook.php or 2 username field to account.php...

CVE-2014-9522

The CVE-2014-9522 entry concerns multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701). The flaws allow remote attackers to inject arbitrary scripts via (1) the author field to guestbook.php and (2) the username field to account.php. The connected documents confi...

EUVD-2014-9337

Multiple cross-site scripting XSS vulnerabilities in CMS Papoo Light 6.0.0 Rev 4701 allow remote attackers to inject arbitrary web script or HTML via the 1 author field to guestbook.php or 2 username field to account.php...

PT-2015-4263

Name of the Vulnerable Software and Affected Versions CMS Papoo Light version 6.0.0 Rev 4701 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the author field to...

CVE-2014-9522: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CMS Papoo Light 6.0.0 Rev 4701 allow remote attackers to inject arbitrary web script or HTML via the 1 author field to guestbook.php or 2 username field to account.php...

Windows-Light-HTTPD-0.1

Buffer overflow in Light HTTPd lhttpd 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request. import urllib2 from time import sleep def targURL: while True: URL = rawinput"\n Please enter the URL of the Light HTTP server you would like to PWN. Ex. http://192.168.1.1\n\n...

CVE-2014-2208

The vulnerability CVE-2014-2208 affects Facebook HHVM prior to version 2.4.2. A CRLF injection in the LightProcess protocol implementation (hphp/util/light-process.cpp) allows remote attackers to cause arbitrary command execution by injecting a newline character before the end of a string. Affect...

CVE-2014-2209: Undefined Security Weakness

Facebook HipHop Virtual Machine HHVM before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory...

CVE-2014-2208: Improper Control of Generation of Code

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rцsemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: -...

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

SEC Consult SA-20140710-2 :: Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system

SEC Consult Vulnerability Lab Security Advisory 20140710-2 ======================================================================= title: Multiple critical vulnerabilites product: Schrack MICROCONTROL emergency light system vulnerable version: before 1.7.0 937 fixed version: 1.7.0 937 impact:...

CVE-2014-6775

The Light for Pets aka com.helenwoodward.light4pets application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Light for Pets aka com.helenwoodward.light4pets application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...