Pi-Hole Adminlte 跨站脚本漏洞

Pi-Hole Adminlte is a Pi-Hole control panel. It is used for statistical More... Pi-Hole adminlte suffers from a cross-site scripting vulnerability that stems from the vulnerability to incorrect neutralization of input during web page generation "cross-site scripting"...

Pi-Hole Adminlte 跨站脚本漏洞

Pi-Hole Adminlte is a Pi-Hole control panel. It is used for statistical More... Pi-Hole adminlte suffers from a cross-site scripting vulnerability that stems from the vulnerability to incorrect neutralization of input during web page generation "cross-site scripting"...

Pi-Hole Adminlte 安全漏洞

Pi-Hole Adminlte is a Pi-Hole control panel. It is used for statistical More... Pi-Hole Adminlte has a security vulnerability that originates from an improperly designed or implemented code development process for a networked system or product...

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

✍️ Description Reflected XSS on any POST parameters with a correct token on /admin/settings.php When field is not in the defined list , $debug value is set to true , and the $POST is dumped without filtering 🕵️‍♂️ Proof of Concept 1. Login as admin 2. Settings - Flush log 3. replace field with XSS...

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

✍️ Description Reflected XSS in POST /admin/scripts/pi-hole/php/customcname.php 🕵️‍♂️ Proof of Concept 1. Login as admin, Go to Local DNS - CNAME Records - Add a new CNAME record 2. Input alert1 in domain field and anything in target domain. 3. The Payload in post body domain is URL encoded, use a...

Why the Raspberry Pi isn’t suitable for IoT

Let’s start by praising the Raspberry Pi: it has brought cheap computing to many, has inspired and enabled education and undoubtedly been a huge benefit. I use my own Pi daily, and we have often used its flexibility to perform hardware testing, from accessing UART to reading flash memory. So why ...

Oracle Linux 6 : kernel (ELSA-2021-9434)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9434 advisory. - kernel futex: Use pistateupdateowner in putpistate Thomas Gleixner 1922249 CVE-2021-3347 Orabug: 33150734 - kernel futex: Handle faults correctly for...

ruspiro-boot (>=0.3.0, <=0.3.2), ruspiro-console (>=0.0.2, <=0.3.2) +6 more potentially affected by CVE-2020-36435 via ruspiro-singleton (>=0.0.2, <=0.3.1)

ruspiro-singleton CARGO version =0.0.2, =0.3.0, =0.0.2, =0.0.2, =0.3.0, =0.1.0, =0.0.2, =0.4.0, =0.0.2, =0.3.1 Source cves: CVE-2020-36435 Source advisory: OSV:GHSA-FQQ2-XP7M-XVM8...

RaspAP Command Injection Vulnerability (CNVD-2021-94940)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. a command injection vulnerability exists in includes/configureclient.php in RaspAP version 2.6.6. An attacker could...

RaspAP Remote Code Execution Vulnerability (CNVD-2021-94941)

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. raspap-webgui in RaspAP version 2.6.6 is vulnerable to remote code execution. The vulnerability stems from insecure...

RaspAP 命令注入漏洞

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. a command injection vulnerability exists in includes/configureclient.php in RaspAP version 2.6.6. An attacker could...

RaspAP安全漏洞

RaspAP is a software solution that can easily deploy Raspberry Pi as a wireless AP access point with a set of responsive WebUI to control WiFi, as easy to use as a home router. raspap-webgui in RaspAP version 2.6.6 is vulnerable to remote code execution. The vulnerability stems from insecure...

RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: RaspAP 2.6.6 - Remote Code Execution RCE Authenticated Date: 23.08.2021 Exploit Author: Moritz Gruber Vendor Homepage: https://raspap.com/ Software Link: https://github.com/RaspAP/raspap-webgui Version: 2.6.6 Tested on: Linux raspberrypi 5.10.52-v7+ import requests from requests.ap...

CVE-2021-38545

Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We...

CVE-2021-38545

Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We...

CVE-2021-38545

Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We...

Code injection

Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We...

CVE-2021-38545

CVE-2021-38545 concerns Raspberry Pi 3 B+ and 4 B devices, up to 2021-08-09, where powering an audio output in certain use cases creates a side channel. The LED power indicator is tied to the power line, so LED light intensity correlates with overall power consumption; the sound played by connect...

CVE-2021-38545

Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We...

Raspberry Pi 3 module B+ 安全漏洞

The Raspberry Pi 3 module B+ is an embedded system development board. A security vulnerability exists in the Raspberry Pi 3 module B+ and 4 B. The vulnerability stems from a problem with the device powering an audio output device under certain usage scenarios. The vulnerability can be exploited b...