Restoring GPT Disk to Incompatible Legacy BIOS System

Challenge After selecting a restore point during the bare metal restore configuration, the following message pops up: OS disk in backup uses GPT disk. This may cause boot issues on BIOS systems. If this is ignored and the restore process completes, the following may happen when the restored machi...

PT-2017-13214

Name of the Vulnerable Software and Affected Versions libbpg version 0.9.7 Description The issue is related to the restore tqb pixels function in hevc filter.c within libavcodec, which is used in libbpg and other products. This function miscalculates a memcpy destination address, allowing remote...

Circle with Disney Configuration Restore Photos File Overwrite Vulnerability(CVE-2017-2916)

Summary An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request trigger this vulnerability. Tested Versions Circ...

CVE-2017-2916

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability...

Command injection

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-2916

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability...

PT-2017-15598

Name of the Vulnerable Software and Affected Versions Circle with Disney version 2.0.1 Description An issue exists in the "/api/CONFIG/restore" functionality, where specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this issue...

CVE-2017-2890: Improper Neutralization of Special Elements used in an OS Command

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

CVE-2017-2916: Improper Link Resolution Before File Access

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request to trigger this vulnerability...

PT-2017-15613

Name of the Vulnerable Software and Affected Versions Circle with Disney version 2.0.1 Description An issue exists in the "/api/CONFIG/restore" functionality where specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can trigger this issue by sending an HTT...

Circle with Disney Command Injection Vulnerability (CNVD-2017-32880)

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A command injection vulnerability exists in the /api/CONFIG/restore function in Circle with Disney version 2.0.1. The vulnerability can ...

Circle with Disney Backlink Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A backlink vulnerability exists in the /api/CONFIG/restore function in Circle with Disney version 2.0.1. An attacker can exploit this...

Circle with Disney Configuration Restore Photos File Overwrite Vulnerability

Summary An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request trigger this vulnerability. Tested Versions Circ...

CVE-2017-15997

In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML fi...

CVE-2017-15997

In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML fi...

CVE-2017-15997

The CVE concerns the Android app NQ Contacts Backup & Restore (version 1.1) where the locally stored user password in SharedPreferences is protected with RC4 using a static key . This configuration allows an attacker with access to the preferences XML file to obtain credentials, representing a lo...

CVE-2017-15998

The CVE concerns the Android app NQ Contacts Backup & Restore version 1.1, which uses DES encryption with a static key to protect transmitted contact data. This practice can allow remote attackers to obtain plaintext data by sniffing network traffic, representing a confidentiality impact describe...

CVE-2017-15999

CVE-2017-15999 affects the Android app NQ Contacts Backup & Restore (version 1.1). The root issue is transmission of credentials without HTTPS: during login, the username is sent in cleartext together with an SHA-1 hash of the password. This enables an attacker to crack the password hash or reuse...

CVE-2017-15999: Cleartext Transmission of Sensitive Information

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...