Design/Logic Flaw

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

CVE-2017-3882

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

CVE-2017-3882

CVE-2017-3882 affects Cisco CVR100W Wireless-N VPN Router due to a UPnP input data range check overflow. The root cause is incomplete UPnP input validation, enabling an unauthenticated, Layer 2-adjacent attacker to trigger a buffer overflow that could reload the device or execute arbitrary code w...

Google Nexus Synaptics Touchscreen Firmware Injection(CVE-2017-0433)

Products Nexus 6P Nexus 9 Android One Pixel Pixel XL Vulnerable Versions Verified on Nexus 9 6.0.1/MOB30W Verified on Nexus 9 7.0/NRD90M Technical Details Due to lenient SELinux and DAC policy, vulnerable Synaptics DSX touchscreen driver sysfs file entires are exposed to an attacker that executes...

ASUS RT-AC * and RT-N * Information Disclosure Vulnerability

ASUS RT-AC and RT-N are two router products. An information disclosure vulnerability exists in ASUS RT-AC and RT-N firmware prior to 3.0.0.4.380.7378. An attacker can exploit the vulnerability to obtain sensitive information...

Default credentials

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPSinfo.xml...

Information disclosure

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map...

Cross site request forgery (csrf)

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

CVE-2017-5891

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

CVE-2017-8877

Consolidated risk: CVE-2017-8877 affects ASUS RT-AC* and RT-N* routers with firmware up to 3.0.0.4.380.7378. The connected CNVD entry and NVD description indicate an information-disclosure flaw in which JSONP responses can reveal sensitive data (notably the SSID). No explicit exploit details, aff...

CVE-2017-5892

ASUS RT-AC* and RT-N* routers with firmware older than 3.0.0.4.380.7378 expose a JSONP information-disclosure flaw that can reveal router data such as a network map. The vulnerability is covered by CVE-2017-5892. Most CSRF-related issues were fixed in firmware 3.0.0.4.380.7378; the JSONP informat...

CVE-2017-5891

CVE-2017-5891 covers CSRF vulnerabilities in ASUS RT-AC* and RT-N* routers prior to firmware 3.0.0.4.380.7378, enabling login and settings changes via the router’s web interface from an attacker-controlled site. Affected models include RT-AC55U/56R/56S/56U/66U/66R/66W/66U family, RT-AC68K/R/U var...

CVE-2017-8878

This entry covers ASUS RT-AC* and RT-N* routers with firmware prior to 3.0.0.4.380.7378. It describes an information-disclosure vulnerability where remote authenticated users can obtain the Wi-Fi password via WPS_info.xml. Impact is partial confidentiality (password exposure) with no integrity or...

S-CMS member_newsinfo.asp page N_id parameter has SQL injection vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. A SQL injection vulnerability exists in the Nid parameter of the /member/membernewsinfo.asp page of the S-CMS enterprise website builder system. Because the program fails to effectively filter the data...

Design/Logic Flaw

A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...

CVE-2017-6620

CVE-2017-6620 affects Cisco CVR100W Wireless-N VPN Router. A vulnerability in the Remote Management ACL allows an unauthenticated, remote attacker to bypass the remote management ACL due to an incorrect ACL decision during ingress to the remote management interface. Impact is bypass of the config...

CVE-2017-6620

A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...

Cisco CVR100W Wireless-N VPN Router Universal Plug-and-Play Buffer Overflow Vulnerability

A vulnerability in the Universal Plug-and-Play UPnP implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2–adjacent attacker to execute arbitrary code or cause a denial of service DoS condition. The remote code execution could occur with root privileges...

Zimperium Publishes Exploits for Patched Android Bugs

Exploits for two patched Android privilege escalation vulnerabilities were published today by security company Zimperium. These are the first publicly released submissions from its N-Days Exploit Acquisition Program, which began in February and had among its stated goals to encourage researchers ...

Information disclosure

An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. Retrieving a specific URL without authentication can reveal sensitive information to an attacker...