Design/Logic Flaw

The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...

Critical Zoom Flaw Lets Hackers Hijack Conference Meetings

A serious vulnerability in Zoom’s desktop conferencing application could allow a remote attacker to hijack screen controls and kick attendees out of meetings. Researchers at Tenable who on Thursday released a proof of concept exploit for the unauthorized command execution flaw said that bug exist...

org.apache.ignite:ignite-aop (1.3.0-incubating), org.apache.ignite:ignite-aws (1.3.0-incubating) +24 more potentially affected by CVE-2018-8018 via org.apache.ignite:ignite-core (1.3.0-incubating)

org.apache.ignite:ignite-core MAVEN version 1.3.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ignite:ignite-core and may be impacted: - org.apache.ignite:ignite-aop 1.3.0-incubating - org.apache.ignite:ignite-aws...

Code injection

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps...

Default credentials

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...

Code injection

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the upda...

CVE-2018-17917

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps...

CVE-2018-17915

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the upda...

CVE-2018-17919

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...

CVE-2018-17917

CVE-2018-17917 affects Hangzhou Xiongmai XMeye P2P Cloud Server. The vulnerability allows an attacker to enumerate potential Cloud IDs by using MAC addresses, enabling discovery of valid devices and connection via supported XMeye apps. Root cause described across sources is predictable/derivable ...

CVE-2018-17917

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps...

CVE-2018-17915

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the upda...

CVE-2018-17919

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...

CVE-2018-17915

CVE-2018-17915 affects Hangzhou Xiongmai XMeye P2P Cloud products (IP cameras, NVRs/DVRs). SEC Consult reports describe a remote code execution/integrity issue in XMeye P2P Cloud, with vulnerable implementations that lack proper protection during update/communication, enabling an attacker to pote...

CVE-2018-18206

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash...

CVE-2018-18206

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash...

Naming & Shaming Web Polluters: Xiongmai

What do we do with a company that regularly pumps metric tons of virtual toxic sludge onto the Internet and yet refuses to clean up their act? If ever there were a technology giant that deserved to be named and shamed for polluting the Web, it is Xiongmai -- a Chinese maker of electronic parts th...

CVE-2018-17919: Hidden Functionality

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...

PT-2018-14267

Name of the Vulnerable Software and Affected Versions Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server affected versions not specified Description The issue concerns the lack of encryption in all device communication, including the XMeye service and firmware update communication. This...

CVE-2018-18206: Integer Overflow or Wraparound

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash...