CVE-2019-14028

CVE-2019-14028 is a Qualcomm Snapdragon vulnerability: a buffer overwrite during memcpy caused by a missing SSID length validation in multiple Snapdragon components (Auto, Compute, Connectivity, and related Snapdragon families on various SoCs). Root cause documented as lack of check on SSID lengt...

CVE-2019-10526

CVE-2019-10526 describes an out-of-bounds write in the Qualcomm WLAN driver caused by a NULL character not properly placed after the SSID. Affected products include Snapdragon Auto/Compute/Consumer Electronics Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music platforms across numerous...

KawaiiDeauther - Jam All Wifi Clients/Routers

Kawaii Deauther is a pentest toolkit whose goal is to perform jam on WiFi clients/routers and spam many fake AP for testing purposes. Dependencies macchanger mdk3 nmcli Installation Dependencies will be automatically installed. $ git clone https://github.com/aryanrtm/KawaiiDeauther $ cd...

Oracle Linux 7 : kernel (ELSA-2020-0374)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0374 advisory. - wireless mwifiex: Fix heap overflow in mmwifiexprocesstdlsactionframe Stanislaw Gruszka 1776156 1776157 CVE-2019-14901 Tenable has extracted the...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2020-7249

The CVE-2020-7249 entry describes an XSS vulnerability in SMC Networks SMC D3G0804W devices (version 3.5.2.5-LAT_GA). The issue enables stored or reflected XSS via the SSID field on the WiFi Network Configuration page after an admin login. Root cause is improper validation/handling of SSID data i...

CVE-2020-7234

Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration Radio 2.4G Wireless X screen after a successful login to the super account...

CVE-2020-7234

Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration Radio 2.4G Wireless X screen after a successful login to the super account...

Cross site scripting

Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration Radio 2.4G Wireless X screen after a successful login to the super account...

CVE-2020-7234

Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration Radio 2.4G Wireless X screen after a successful login to the super account...

CVE-2020-7234

CVE-2020-7234 affects Ruckus ZoneFlex R310 devices (version 104.0.0.0.1347). It is a Stored XSS vulnerability triggered in the SSID field on the Wireless X screen after logging in to a super account, arising from lack of proper input validation in the web app. Exploitation is described as client-...

USN-4226-1 linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities

Michael Hanselmann discovered that the CIFS implementation in the Linux kernel did not sanitize paths returned by an SMB server. An attacker controlling an SMB server could use this to overwrite arbitrary files. CVE-2019-10220 It was discovered that a heap-based buffer overflow existed in the...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4226-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4226-1 advisory. Michael Hanselmann discovered that the CIFS implementation in the Linux kernel did not sanitize paths returned by an SMB server. An attacker controlling ...

CVE-2019-18842

A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...

CVE-2019-18842

A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...

CVE-2019-18842

A cross-site scripting XSS vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by...

CVE-2019-3985

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter...

CVE-2019-3985

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter...

Command injection

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter...

USN-4211-2 linux-lts-xenial, linux-aws vulnerabilities

USN-4211-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kerne...