CVE-2019-20567

The CVE-2019-20567 issue affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) on Exynos chipsets. The root cause is a heap overflow in up_parm, which leads to code execution in the bootloader. Documented impact is high/severe (bootloader code execution possible). Exploitation details...

CVE-2019-20555

An issue was discovered on Samsung mobile devices with N7.x software. The Gallery app allows attackers to view all pictures of a locked device. The Samsung ID is SVE-2019-15189 October 2019...

CVE-2019-20551

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Attackers can bypass Factory Reset Protection FRP via a Class 0 Type Message. The Samsung ID is SVE-2019-14941 October 2019...

CVE-2019-20533

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 released in China or India software. The S Secure app can launch masked apps without a password. The Samsung ID is SVE-2019-13996 December 2019...

Stack overflow

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 Exynos chipsets software. There is a stack overflow in the kernel driver. The Samsung ID is SVE-2019-15034 November 2019...

CVE-2019-20549

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 Broadcom chipsets software. A heap out-of-bounds access can occur during LE Packet reception in Broadcom Bluetooth. The Samsung ID is SVE-2019-15724 November 2019...

CVE-2019-20542

CVE-2019-20542 affects Samsung mobile devices running Android N (7.1), O (8.x), and P (9.0) on Exynos chipsets. The issue is a kernel driver stack overflow. No exploit details or specific vulnerable components/version numbers are provided beyond this description. No remediation or patch version i...

CVE-2019-20540

CVE-2019-20540 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) Exynos software. The issue is a buffer over-read in the core touch screen driver that can lead to a possible information leak. Connected sources corroborate the same description; no explicit patch/version details or ...

CVE-2019-20539

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 Broadcom chipsets software. An out-of-bounds Read in the Wi-Fi vendor command leads to an information leak. The Samsung ID is SVE-2019-14869 November 2019...

Medium: kernel-livepatch-4.14.165-133.209

Issue Overview: There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the nttyreceivebufcommon function in drivers/tty/ntty.c.CVE-2020-8648 Affected Packages: kernel-livepatch-4.14.165-133.209 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)

Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass Config Upload Exploit Title: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass Config Upload Date: 2019-11-20 Exploit Author: Elber Tavares Vendor Homepage: https://www.intelbras.com/ Software Link:...

Double free

The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...

CVE-2019-19943

CVE-2019-19943 affects Pablo Quick n Easy Web Server (quickweb.exe) v3.3.8. The HTTP service is vulnerable to remote unauthenticated heap memory corruption when handling a large host or domain parameter, with a double free cited as the underlying cause. This can lead to remote code execution per...

CVE-2019-19943

The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may be possible to achieve remote code execution because of a double free...

Quick N Easy Web Server 3.3.8 Denial Of Service

Title: Quick N Easy Web Server 3.3.8 - Denial of Service PoC Date: 2019-12-25 Author: Cody Winkler Vendor Homepage: https://www.pablosoftwaresolutions.com/ Software Link: https://www.pablosoftwaresolutions.com/html/quickneasywebserver.html Version: $ python exploit.py 127.0.0.1 80 """ from future...

Moxa AWK-3131A iw_console Privilege Escalation Vulnerability

Summary An exploitable privilege escalation vulnerability exists in the iwconsole functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send...

Quick N Easy Web Server 3.3.8 - Denial of Service Exploit

Title: Quick N Easy Web Server 3.3.8 - Denial of Service PoC Author: Cody Winkler Vendor Homepage: https://www.pablosoftwaresolutions.com/ Software Link: https://www.pablosoftwaresolutions.com/html/quickneasywebserver.html Version: $ python exploit.py 127.0.0.1 80 """ from future import...

Quick N Easy Web Server 3.3.8 - Denial of Service (PoC)

Quick N Easy Web Server 3.3.8 - Denial of Service PoC Title: Quick N Easy Web Server 3.3.8 - Denial of Service PoC Date: 2019-12-25 Author: Cody Winkler Vendor Homepage: https://www.pablosoftwaresolutions.com/ Software Link: https://www.pablosoftwaresolutions.com/html/quickneasywebserver.html...

Moxa AWK-3131A iw_webs Account Settings Improper Access Control Vulnerability

Summary An exploitable improper access control vulnerability exists in the iwwebs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the...

Moxa AWK-3131A multiple iw_* utilities Use of Hard-coded Credentials Vulnerability

Summary An exploitable use of hard-coded credentials vulnerability exists in multiple iw utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. Tested Versions Moxa...