Sogou Input Method of Beijing Sogou Information Service Co.

Sogou Input Method is a Chinese character input method tool launched in June 2006 by Sogou Sogou. Sogou Input Method has a dll hijacking vulnerability, which can be exploited by attackers to remotely control a user's computer or implant a Trojan horse...

Cheetah Mobile's Cheetah Browser suffers from dll hijacking vulnerability

Cheetah Browser is an easy-to-use browsing service that will bring you convenient help in a short period of time. Cheetah Mobile's Cheetah Browser has a dll hijacking vulnerability that can be exploited by attackers to cause a user's computer to be remotely controlled or implanted with a Trojan...

PT-2020-1749

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13 Description An exploitable command injection vulnerability exists in the encrypted diagnostic script functionality. A specially crafted diagnostic script file can cause arbitrary busybox commands to be...

WordPress wpCentral Plugin < 1.5.1 Improper Access Control Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

PT-2020-1751

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13 Description The issue exists due to the lack of neutralization of special elements used in an operating system command. This allows for a command injection vulnerability in the iwwebs functionality, where a...

CVE-2019-5140: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attack...

CVE-2019-5138: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker...

CVE-2019-5141: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can...

PT-2020-1752

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13 Description A command injection vulnerability exists in the iw webs functionality, allowing an attacker to gain remote control over the device. This can be achieved by sending specially crafted commands,...

PT-2020-8535

Name of the Vulnerable Software and Affected Versions: Drobo 5N2 version 4.0.5 Description: The issue is related to the lack of authentication/authorization validation in all optional applications. This allows any user who can access the device over the network to interact with and control these...

Moxa AWK-3131A iw_webs iw_serverip Parameter Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An...

Moxa AWK-3131A Encrypted Diagnostic Script Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An...

Moxa AWK-3131A iw_webs DecryptScriptFile file name Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. A...

Hamas Ensnares Israeli Soldiers with Pretty 'Ladies'

Hamas has been caught taking a classic “catfish” approach, to tempt Israeli soldiers into installing spyware on their phones. Members posed as teen girls who are looking for quality chat time. This is the third time that the Palestinian group has used the tactic – but this time it upped its...

How to prevent a rootkit attack

If you're ever at the receiving end of a rootkit attack, then you'll understand why they are considered one of the most dangerous cyberthreats today. Rootkits are a type of malware designed to stay undetected on your computer. Cybercriminals use rootkits to remotely access and control your machin...

'Cable Haunt' Bug Plagues Millions of Home Modems

UPDATED Multiple cable modems used by ISPs to provide broadband into homes have a critical vulnerability in their underlying reference architecture that would allow an attacker full remote control of the device. The footprint for the affected devices numbers in the hundreds of millions worldwide...

TikTok Riddled With Security Flaws

Researchers say they have discovered several major vulnerabilities in the short form video app TikTok. The reported vulnerabilities come as scrutiny around the Chinese-owned platform increases. Researchers say the most serious vulnerability in the platform could allow attackers to remotely take...

HomeAutomation 3.3.2 Authentication Bypass

HomeAutomation v3.3.2 Authentication Bypass Exploit Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Summary: HomeAutomation is an open-source web interface and scheduling solution. It was initially made for use with the Telldus...

HomeAutomation 3.3.2 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit: HomeAutomation 3.3.2 - Authentication Bypass Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisor...

HomeAutomation 3.3.2 - Authentication Bypass

HomeAutomation 3.3.2 - Authentication Bypass Exploit: HomeAutomation 3.3.2 - Authentication Bypass Date: 2019-12-30 Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips...