2500 matches found
HomeAutomation 3.3.2 - Authentication Bypass
Exploit: HomeAutomation 3.3.2 - Authentication Bypass Date: 2019-12-30 Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisory ID: ZSL-2019-5557 Advisory URL:...
HomeAutomation v3.3.2 Authentication Bypass Exploit
Summary HomeAutomation is an open-source web interface and scheduling solution. It was initially made for use with the Telldus TellStick, but is now based on a plugin system and except for Tellstick it also comes with support for Crestron, OWFS and Z-Wave using OpenZWave. It controls your devices...
Denial of Service Vulnerability in Multiple Xiaomi Products
Xiaomi DGNWG03LM and others are products of Xiaomi, a Chinese company.Xiaomi DGNWG03LM is a smart home gateway device.ZNCZ03LM is a smart switch device.MCCGQ01LM is a smart remote control. A security vulnerability exists in multiple Xiaomi products. An attacker can exploit the vulnerability to...
Denial of Service Vulnerability in Multiple Xiaomi Products (CNVD-2020-03067)
Xiaomi DGNWG03LM and others are products of Xiaomi, a Chinese company.Xiaomi DGNWG03LM is a smart home gateway device.ZNCZ03LM is a smart switch device.MCCGQ01LM is a smart remote control. A security vulnerability exists in multiple Xiaomi products. An attacker can exploit the vulnerability to...
Jiangsu Jinzhi Technology Co., Ltd. iPACS-5772 suffers from denial-of-service vulnerability (CNVD-2020-01593)
iPACS-5772 is a measurement and control device with remote control, telemetry, telecommunication functions, logic blocking function, programmed operation function, device self-test, time-alignment function, and the device is equipped with software time-alignment and hardware time-alignment...
The vulnerability of TeamViewer’s software for remote control of computers lies in the fact that the operation data can escape beyond the buffer in memory, allowing a hacker to cause a service failure.
The vulnerability of TeamViewer’s software for remote control is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
Design/Logic Flaw
Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In...
PT-2019-12831
Name of the Vulnerable Software and Affected Versions Inateck BCST-60 affected versions not specified Description The Inateck BCST-60 wireless barcode scanner is prone to keystroke injection attacks due to unencrypted and unauthenticated data communication. This allows an attacker to send arbitra...
The vulnerability of the FasterXML function (com.zaxxer.hikari.HikariDataSource) in the Jackson-Databind JSON file parsing library allows a attacker to gain full control over the system.
The vulnerability of the FasterXML function com.zaxxer.hikari.HikariDataSource in the Jackson-Databind JSON parsing library involves memory corruption due to the incorrect structure of data being restored. Exploiting this vulnerability could allow an attacker to gain full control over the system...
CVE-2019-18980
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
Authentication flaw
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
CVE-2019-18980
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
CVE-2019-18980
The CVE describes an authentication-less control API on Signify Philips Taolight Smart Wi‑Fi Wiz Connected LED Bulb 9290022656. A remote attacker with network access can operate the bulb: turn it on/off, adjust color, or change brightness, due to no authentication or encryption on the control API...
CVE-2019-16110
The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address, because packet data can be injected into the unencrypted UDP packet stream...
PT-2019-15737
Name of the Vulnerable Software and Affected Versions Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb version 9290022656 Description The issue allows remote users to control the bulb's operation due to an unprotected API. This enables anyone with network access to the bulb to turn it ...
CVE-2019-18980: Missing Authentication for Critical Function
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...
The vulnerability of the EAP Controller remote management utility lies in the lack of authentication for a critical function, allowing a malicious actor to control the target server and execute arbitrary Java or bytecode.
The vulnerability of the EAP Controller remote management utility lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to remotely control the target server and execute arbitrary Java or bytecode...
WordPress codepress-admin-columns injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. codepress-admin-columns is a content management plugin used in it. An injection vulnerability exists in WordPress...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...