CVE-2018-6644

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

CVE-2018-6644: NULL Pointer Dereference

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

U.S. Dept Of Defense: Blind SQL injection on ████████

Summary: I discovered that a post request made to https://████████/elist/viewem6.php is vulnerable to SQL injection and is quite clearly vulnerable as I was able to induce a 2 second hang on the web page. Additionally I was able to discover the mysql version with a true/false condition...

Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution

Exploit Title: Adobe Coldfusion BlazeDS Java Object Deserialization RCE Date: February 6, 2018 Exploit Author: Faisal Tameesh @DreadSystems Company: Depth Security https://depthsecurity.com Version: Adobe Coldfusion 11.0.03.292866 Tested On: Windows 10 Enterprise 10.0.15063 CVE: CVE-2017-3066...

Hotspot Shield Information Disclosure Vulnerability

Hotspot Shield is a suite of VPN software for accessing free and open networks. A security vulnerability exists in Hotspot Shield that stems from the program's failure to adequately filter user input. The vulnerability can be exploited by sending a POST request to the /status.js file with the...

Design/Logic Flaw

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

CVE-2018-6479

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

CVE-2018-6460

Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the...

Code injection

Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the...

CVE-2018-6460

Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the...

Exploit for CVE-2018-6479

Netwave IP Camera server vulnerable to unauthenticated Denial...

CVE-2018-6479: Undefined Security Weakness

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

PT-2018-17574

Name of the Vulnerable Software and Affected Versions Netwave IP Camera devices affected versions not specified Description An issue allows an unauthenticated attacker to crash a device by sending a POST request with a large body size to the "/" API endpoint. Recommendations At the moment, there ...

CVE-2018-6407

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

Code injection

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

CVE-2018-6407

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

CVE-2018-6407: Improper Input Validation

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device...

PT-2018-17538

Name of the Vulnerable Software and Affected Versions Conceptronic CIPCAMPTIWL V3 version 0.61.30.21 Description An issue allows an unauthenticated attacker to crash a device by sending a POST request with a large body size to the "hy-cgi/devices.cgi?cmd=searchlandevice" endpoint. This results in...

AsusWRT router/httpd/httpd.c file access bypass vulnerability

ASUS AsusWRT is a set of router operating systems from ASUS. A security vulnerability exists in the 'handlerequest' function of the router/httpd/httpd.c file in versions prior to ASUS AsusWRT 3.0.0.4.38410007. An attacker can exploit this vulnerability to execute a POST request...

AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution

Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 Background and summary AsusWRT is the...