AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution

AsusWRT Router 3.0.0.4.380.7743 - LAN Remote Code Execution Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last...

Multiple vulnerabilities in all versions of ASUS routers

1 ASUSWRT 3.0.0.4.376 - multiple vulnerabilities in httpd server all versions of AsusWRT at the time of report to vendor, for previous 376 version see next section 1. Highly predictable session tokens The session token is generated for an authenticated user using stdlib rand function. The token...

Brickcom IP Camera - Credentials Disclosure Vulnerability

Exploit for hardware platform in category web applications 1. Advisory Information ======================================== Title: Brickcom IP-Camera Remote Credentials and Settings Disclosure Vendor Homepage: http://www.brickcom.com Tested on Camera types: WCB-040Af, WCB-100A, WCB-100Ae, OB-302N...

Brickcom IP Camera - Credentials Disclosure

Advisory Information ======================================== Title: Brickcom IP-Camera Remote Credentials and Settings Disclosure Vendor Homepage: http://www.brickcom.com Tested on Camera types: WCB-040Af, WCB-100A, WCB-100Ae, OB-302Np, OB-300Af, OB-500Af Remotely Exploitable: Yes...

Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)

Qemu: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714 1296080 Qemu: i386: NULL pointer dereference in vapicwrite CVE-2016-1922 1292767 qemu: Stack-based buffer overflow in megasasctrlgetinfo CVE-2015-8613 1293305 qemu-kvm: Infinite loop and out-of-bounds transfer start i...

Linux Embedded Firmware Dynamic Analysis: FIRMADYNE

FIRMADYNE is an automated and scalable system for performing emulation and dynamic analysis of Linux-based embedded firmware. It includes the following components: modified kernels MIPS: v2.6.32 , ARM: v4.1 , v3.10 for instrumentation of firmware execution; a userspace NVRAM library to emulate a...

Oracle Linux 7 : qemu-kvm (ELSA-2016-0083)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0083 advisory. - Resolves: bz1298047 CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations rhel-7.2.z Tenable has extracted the preceding...

Qemu: nvram: OOB r/w access in processing firmware configurations

An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged CAPSYSRAWIO guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with...

CVE-2015-5945

The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters...

Code injection

The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters...

CVE-2015-5945

CVE-2015-5945 is an Apple OS X Sandbox elevation-of-privilege vulnerability. The issue affects OS X versions prior to 10.11.1 in the Sandbox subsystem and is exploitable by local users via vectors involving NVRAM parameters, enabling privilege escalation. Exploitation status is not detailed in th...

CVE-2015-5945

The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters...

Oracle: Security Advisory (ELSA-2015-0674)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kernel security and bug fix update

2.6.32-504.12.2 - infiniband core: Prevent integer overflow in ibumemget address arithmetic Doug Ledford 1181173 1179327 CVE-2014-8159 2.6.32-504.12.1 - fs splice: perform generic write checks Eric Sandeen 1163798 1155900 CVE-2014-7822 2.6.32-504.11.1 - virt kvm: excessive pages un-pinning in...

Cisco IOS 11.x TFTP Server Long File Name Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5328/info A problem has been discovered in Cisco IOS and MGX switches that could result in a denial of service, and potential code execution. It has been discovered that the TFTP server file name handling of Cisco IOS is...

ARRIS DG860A NVRAM Backup Password Disclosure

No description provided by source...

ARRIS DG860A NVRAM Backup Password Disclosure

Exploit for hardware platform in category web applications ! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain...

ARRIS DG860A - NVRAM Backup Password Disclosure

ARRIS DG860A - NVRAM Backup Password Disclosure ! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text...

ARRIS DG860A - NVRAM Backup Password Disclosure

!/usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text. box:arris-dev cosmo$ wget http://192.168.0.1/router.dat...

ARRIS DG860A NVRAM Backup Compressor / Decompressor

! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain text. box:arris-dev cosmo$ wget http://192.168.0.1/router.da...