Unauthorized Access Vulnerability in DATA Projector of Sony (China) Co.

Sony China Ltd. was established by Sony Corporation in Beijing in October 1996 as a wholly-owned subsidiary to unify the management and coordination of Sony's domestic business activities in China. An unauthorized access vulnerability exists in Sony China Ltd DATA Projector, which can be exploite...

Epson USB Display 1.6.0.0 Unquoted Service Path

Exploit Title: Epson USB Display 1.6.0.0 - 'EMPUDSA' Unquote Service Path Discovery by: Hector Gerbacio Discovery Date: 2021-02-05 Vendor Homepage: https://epson.com.mx/ Tested Version: 1.6.0.0 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 8.1 con Bing Step to discover Unquoted...

Vulnerability Spotlight: Authentication bypass vulnerability in some Epson projectors

Yuri Kramarz of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. The Epson EB-1470UI Projector contains an authentication bypass vulnerability in its web control functionality. This projector allows users to control it over the web. However, an adversary could trick a user into...

Epson EB-1470Ui ESPON Web Control Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can...

CVE-2020-9039

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints they allow unauthenticated access.The /settings REST endpoint exposed by the projector process is an endpoint that...

CVE-2020-9039

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints they allow unauthenticated access.The /settings REST endpoint exposed by the projector process is an endpoint that...

Design/Logic Flaw

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints they allow unauthenticated access.The /settings REST endpoint exposed by the projector process is an endpoint that...

Hardcoded credentials

The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-screen - ensuring only those who can view it are streaming.In addition to the password, each projector has a hardcoded...

ASUS B1M projector remote commands execution Vulnerability

We recently obtained a ASUS B1M projector0 and have been exploring its capabilities when we discovered trivial to exploit vulnerabilities. The ASUS B1M features a small Wi-Fi adapter for a direct wireless connection to a notebook PC, or Android and iOS devices. The projector comes with an embedde...

Vyomy 3D Hologram Projector - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Vyomy 3D Hologram Projector published at the 'play' market has multiple vulnerabilities...

InFocus IN3128HD Projector Validates Bypass Vulnerability

The InFocus IN3128HD projector is a projector product used in the education industry. The InFocus IN3128HD firmware version 0.26 fails to properly handle user access, allowing remote attackers to bypass authentication and gain unauthorized access by sending a main.html request...

CVE-2014-8384

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

CVE-2014-8384

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

Cross site request forgery (csrf)

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

CVE-2014-8383

The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html...

CVE-2014-8383

The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html...

CVE-2014-8384

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

CVE-2014-8384

The CVE-2014-8384 entry concerns the InFocus IN3128HD projector (firmware 0.26). The issue is missing authentication for the CGI file webctrl.cgi.elf in cgi-bin, allowing an unauthenticated remote attacker to modify DHCP/server IP configurations, reboot the device, and change the device hostname,...

CVE-2014-8383

The CVE-2014-8383 entry concerns the InFocus IN3128HD projector with firmware 0.26. Public sources describe an authentication bypass in the web interface (by accessing /main.html after login) and missing authentication for the CGI file /cgi-bin/webctrl.cgi.elf, enabling unauthenticated access to ...

Authentication Vulnerabilities Identified in Projector Firmware

The manufacturer of a popular projector found primarily in classrooms is neglecting to address several authentication bugs that exist in the device that could open it up to hacks. It’s technically the firmware for the projector, InFocus IN3128HD, version 0.26, that’s vulnerable. The web interface...